Bug 2565158 (CVE-2026-110289) - CVE-2026-110289 grafana: GIT SYNC CONNECTIONS COULD SEND CREDENTIALS TO INTERNAL ADDRESSES
Summary: CVE-2026-110289 grafana: GIT SYNC CONNECTIONS COULD SEND CREDENTIALS TO INTER...
Keywords:
Status: NEW
Alias: CVE-2026-110289
Deadline: 2026-11-10
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-02 12:50 UTC by OSIDB Bzimport
Modified: 2026-11-12 15:03 UTC (History)
19 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-02 12:50:09 UTC 
CVE-2026-110289: GIT SYNC CONNECTIONS COULD SEND CREDENTIALS TO INTERNAL ADDRESSES

Score: 5.5 (MEDIUM) 

Short description of the vulnerability: 

An organization administrator could set a GitHub Enterprise App or GitLab connection URL to a loopback or internal address, and Grafana would send the connection's credentials there. The fixed versions block such addresses. 

Known mitigations: 

Point Git Sync connection URLs only at trusted hosts, and review existing connections. 

Affected products and versions: 

Grafana Enterprise 13.1.0 to 13.1.9, 13.2.0 to 13.2.5, and 13.3.0 (GitHub Enterprise and GitLab connections). Grafana OSS 13.3.0 is also affected when using the gitOAuth connector. 

Affected platforms: 

Self-managed (on-premise)
Note You need to log in before you can comment on or make changes to this bug.