Bug 2565158 (CVE-2026-110289)

Summary:	CVE-2026-110289 grafana: GIT SYNC CONNECTIONS COULD SEND CREDENTIALS TO INTERNAL ADDRESSES
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, jbalunas, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, security-response-team, sfeifer, sostapov, tsze, vereddy, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Grafana. This vulnerability allows an authenticated organization administrator to cause information disclosure by configuring Git Sync connection endpoints to point to loopback or internal network addresses. Under these conditions, Grafana transmits the connection credentials to the specified internal address, exposing sensitive authentication data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-11-10

Description OSIDB Bzimport 2026-11-02 12:50:09 UTC

CVE-2026-110289: GIT SYNC CONNECTIONS COULD SEND CREDENTIALS TO INTERNAL ADDRESSES

Score: 5.5 (MEDIUM) 

Short description of the vulnerability: 

An organization administrator could set a GitHub Enterprise App or GitLab connection URL to a loopback or internal address, and Grafana would send the connection's credentials there. The fixed versions block such addresses. 

Known mitigations: 

Point Git Sync connection URLs only at trusted hosts, and review existing connections. 

Affected products and versions: 

Grafana Enterprise 13.1.0 to 13.1.9, 13.2.0 to 13.2.5, and 13.3.0 (GitHub Enterprise and GitLab connections). Grafana OSS 13.3.0 is also affected when using the gitOAuth connector. 

Affected platforms: 

Self-managed (on-premise)