Uncontrolled Resource Consumption Vulnerability in Grafana's Git Sync Feature
CVE-2026-95502

5.3MEDIUM

Key Information:

Vendor

Grafana
Status
Nanogit
Grafana Oss
Grafana Enterprise
Vendor
CVE Published:
13 October 2026

What is CVE-2026-95502?

A vulnerability exists within Grafana's Git Sync feature, specifically when configured with certain Git servers. If these servers return oversized or highly compressed responses, it can lead to excessive memory usage in Grafana, potentially causing performance degradation or application instability. Exploitation of this vulnerability requires an administrator to have set up Git Sync with the vulnerable server.

Affected Version(s)

Grafana Enterprise 13.0.0 < 13.0.11

Grafana Enterprise 13.1.0 < 13.1.8

Grafana Enterprise 13.2.0 < 13.2.4

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.