{"id":"CVE-2026-110289","kind":"vulnerability","aliases":["CVE-2026-110289"],"related":[],"title":"Grafana: Organization Admins can leak Git Sync secrets to internal addresses","description":"A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).","summary":"A user with the Organization Admin role could set the server or token URL of a Git Sync connection to a loopback or internal address. Grafana would then send the connection's OAuth client secret, tokens, or GitHub App-signed requests to that address.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["git-sync","grafana","infrastructure","self-hosted"],"not_affected_if":["git-sync-unused","no-org-admin-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T15:17:14+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:49+00:00","updated_at":"2026-11-11T15:29:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T15:29:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: Organization Admins can leak Git Sync secrets to internal addresses","impact":"medium","summary":"A user with the Organization Admin role could set the server or token URL of a Git Sync connection to a loopback or internal address. Grafana would then send the connection's OAuth client secret, tokens, or GitHub App-signed requests to that address.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["grafana","self-hosted","git-sync"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"OAuth client secret and tokens leak to an internal address","analyst_note":"Find the affected and fixed Grafana versions and the vendor advisory, using the NVD link in the sources.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["git-sync-unused","no-org-admin-users"],"who_is_affected":"Grafana instances that use Git Sync connections with OAuth or GitHub App credentials, where some users hold the Organization Admin role. The exposure is on the Grafana server, which makes outbound requests to the configured URL. Instances without Git Sync, or where only trusted admins hold that role, are less exposed. The sources do not say which Grafana versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4539,"output_tokens":500,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110289':14A,17A '-2026':13A,16A 'address':11A,50B,70B,95C,120C 'admin':3A,31B,76C 'app':65B,115C 'app-sign':64B 'client':59B,105C 'connect':44B,56B,89C,102C 'could':33B,78C 'cve':12A,15A 'forgeri':125C 'git':6A,19B,42B,87C 'git-sync':18B 'github':63B,114C 'grafana':1A,21B,51B,97C 'host':25B 'infrastructur':22B 'intern':10A,49B,94C 'key':117C 'leak':5A 'loopback':47B,92C 'oauth':58B,104C 'organ':2A,30B,75C 'point':79C 'privat':116C 'request':67B,110C,124C 'role':32B,77C 'secret':8A,60B,106C 'self':24B 'self-host':23B 'send':54B,100C 'server':36B,81C,122C 'server-sid':121C 'set':34B 'side':123C 'sign':66B,111C 'sync':7A,20B,43B,88C 'token':38B,61B,83C,108C 'url':39B,84C 'user':27B,72C 'would':52B,98C","nicknames":[],"mitigations":[],"who_affected":"Grafana instances that use Git Sync connections with OAuth or GitHub App credentials, where some users hold the Organization Admin role. The exposure is on the Grafana server, which makes outbound requests to the configured URL. Instances without Git Sync, or where only trusted admins hold that role, are less exposed. The sources do not say which Grafana versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gitsync","grafana","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-110289':14A,17A '-2026':13A,16A 'address':11A 'admin':3A 'cve':12A,15A 'git':6A 'grafana':1A 'intern':10A 'leak':5A 'organ':2A 'secret':8A 'sync':7A","search_b":"'address':50B,70B 'admin':31B 'app':65B 'app-sign':64B 'client':59B 'connect':44B,56B 'could':33B 'git':19B,42B 'git-sync':18B 'github':63B 'grafana':21B,51B 'host':25B 'infrastructur':22B 'intern':49B 'loopback':47B 'oauth':58B 'organ':30B 'request':67B 'role':32B 'secret':60B 'self':24B 'self-host':23B 'send':54B 'server':36B 'set':34B 'sign':66B 'sync':20B,43B 'token':38B,61B 'url':39B 'user':27B 'would':52B","search_c":"'address':95C,120C 'admin':76C 'app':115C 'client':105C 'connect':89C,102C 'could':78C 'forgeri':125C 'git':87C 'github':114C 'grafana':97C 'intern':94C 'key':117C 'loopback':92C 'oauth':104C 'organ':75C 'point':79C 'privat':116C 'request':110C,124C 'role':77C 'secret':106C 'send':100C 'server':81C,122C 'server-sid':121C 'side':123C 'sign':111C 'sync':88C 'token':83C,108C 'url':84C 'user':72C 'would':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110289","severity":null,"published_at":"2026-11-11T15:17:14+00:00","modified_at":"2026-11-11T15:17:14+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}