PT-2026-145246
CVE-2026-110289
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
5.5
MediumMetricsAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).
Found an issue in the description? Have something to add? Feel free to write us 👾