CVE-2026-15577

Grafana is vulnerable to an incorrect authorization issue where a user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration. This is possible by interacting with the connection's status subresource . In version 12.4 , the affected...

CVE-2026-30963

Capsule (a Kubernetes multi-tenancy framework) relied on a webhook to validate namespace updates, but prior to v0.13.0 it did not intercept namespace/status or namespace/finalize subresource changes. This omission enables a tenant with permission to modify those subresources to hijack other names...