Description
A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 13.1.0 – ≤ 13.1.9, 13.2.0 – ≤ 13.2.5, 13.3.0 – ≤ 13.3.0 | — |
| Grafana | Grafana OSS | 13.3.0 – ≤ 13.3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.13-0.6.hum1 | RHSA-2026:93601 |
Advisories 2
- RHSA-2026:93601 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4568 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-110289 vendor-advisory