CVE-2026-110289
Received
Received - Intake
Grafana Server-Side Request Forgery in Git Sync
Vulnerability report for CVE-2026-110289, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Grafana Labs
Description
Description
A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Grafana | Grafana Enterprise | From 13.1.0 (inc) to 13.1.9 (inc) |
| Grafana | Grafana Enterprise | From 13.2.0 (inc) to 13.2.5 (inc) |
| Grafana | Grafana Enterprise | 13.3.0 |
| Grafana | Grafana OSS | 13.3.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
