Server-Side Request Forgery Vulnerability in Grafana by Grafana Labs
CVE-2026-110289

5.5MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Enterprise
Grafana Oss
Vendor
CVE Published:
11 November 2026

What is CVE-2026-110289?

A vulnerability exists in Grafana that allows users with the Organization Admin role to misconfigure Git Sync connections by directing the server or token URL to a loopback or internal address. This misconfiguration could lead to the unauthorized exposure of OAuth client secrets, tokens, and requests authenticated with the GitHub App private key, effectively resulting in a server-side request forgery scenario. Proper mitigation steps and updates should be applied to maintain the security of your Grafana instance.

Affected Version(s)

Grafana Enterprise 13.1.0 <= 13.1.9

Grafana Enterprise 13.2.0 <= 13.2.5

Grafana Enterprise 13.3.0

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.