CVE-2026-110289 · Infrastructure
NO FIX YET
A user with the Organization Admin role could set the server or token URL of a Git Sync connection to a loopback or internal address. Grafana would then send the connection's OAuth client secret, tokens, or GitHub App-signed requests to that address.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Grafana instances that use Git Sync connections with OAuth or GitHub App credentials, where some users hold the Organization Admin role. The exposure is on the Grafana server, which makes outbound requests to the configured URL. Instances without Git Sync, or where only trusted admins hold that role, are less exposed. The sources do not say which Grafana versions are affected.
Not affected if git-sync-unused, no-org-admin-users
Who cares git-sync, grafana, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.