Grafana: read-only Git Sync users can change a connection's configuration via its status subresource

Impact

A user or service account holding only read access to a Git Sync provisioning connection can modify that connection's configuration through its status subresource, because authorization is checked on the main resource and not on the subresource. Git Sync is what defines where Grafana's dashboards and alert rules come from, so an actor who can repoint or reconfigure a connection can change what the observability layer displays and alerts on - the thing operators look at to decide whether a GPU fleet is healthy. Integrity only; no data disclosure is claimed. On Grafana 12.4 the affected API exists only when the experimental provisioning feature toggle is enabled, which limits this to instances that opted in.

Who can reach it

Any authenticated Grafana user or service account with read-only access to a Git Sync connection, over the network. No user interaction.

What to do

Upgrade to the fixed Grafana versions listed in the vendor advisory and restart the server. If you are on 12.4 and not using Git Sync, disabling the experimental provisioning feature toggle removes the affected API - that is a config change plus restart, no node work. After patching, review Git Sync connection configurations against what you expect, since changes made through this path would look like ordinary status updates.

References

Related entries

• Keycloak: authenticated user can exhaust server memory via unbounded Prometheus metric labelsCVE-2026-16100 · Keycloak (user-event Prometheus metrics)Medium
• open-iscsi iscsiuio (DHCPv6 handling): Integer underflow and out-of-bounds read in iscsiuio's DHCPv6 handlingCVE-2026-18727 · open-iscsi iscsiuio (DHCPv6 handling)Medium
• Grafana: injected timeGroup macro in a SQL query exhausts memory and kills the server processCVE-2026-19475 · Grafana SQL data sources (regex macro parsing, timeGroup injected via WHERE clause)Medium
• Grafana: unbounded request body on the Prometheus rule conversion API crashes the server via out-of-memoryCVE-2026-33374 · Grafana Prometheus rule conversion APIMedium
• lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload fourCVE-2026-46433 · lldpd (802.1Q VLAN tag stripping in lldpd_decode)Medium
• Apache Airflow: Bulk Variables API skips key-based redaction, returning JSON variable secrets in cleartextCVE-2026-48828 · Apache Airflow (Bulk Variables API, secrets masker key-based redaction)Medium