CVE-2026-110289: Git Sync connections send credentials to unvalidated server URLs
A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the Organization Admin role and the ability to configure a Git Sync connection. They can set its server or token URL to a loopback or internal address.
What data could be exposed to an internal endpoint?
Grafana may send the Git Sync connection's OAuth client secret and tokens to the specified address. For GitHub App connections, it may send requests signed with the GitHub App private key.
What systems are most at risk?
Instances where Organization Admin access is granted to untrusted or insufficiently trusted users are exposed. The affected request target can be a loopback address or an internally reachable address from the Grafana server.