{"id":"CVE-2026-110289","aliases":["EUVD-2026-123547","GHSA-97fx-j86f-w2rp","RHSA-2026:93601"],"status":"published","title":"Git Sync connections send credentials to unvalidated server URLs","description":"A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.002,"percentile":0.10007,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-11-11T15:03:27Z","modified":"2026-11-14T13:00:38Z","products":[{"vendor":"grafana","product":"grafana enterprise"},{"vendor":"grafana","product":"grafana oss"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-110289","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110289","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-97fx-j86f-w2rp"},{"url":"https://access.redhat.com/errata/RHSA-2026:93601","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-115754","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-115897","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-116591","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-116689","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14242","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13721","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110289","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111024","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107509","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110992","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93601.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110289","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559880","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115754","tags":["advisory"]},{"url":"https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","tags":["article"]},{"url":"https://github.com/yahoo/serialize-javascript/pull/235","tags":["article"]},{"url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3","tags":["article"]},{"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/serialize-javascript-7.0.1-before-7.1.3-xss-via-unescaped-script-in-function-body","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115897","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115897","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2561461","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116591","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116591","tags":["advisory"]},{"url":"https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d","tags":["article"]},{"url":"https://github.com/klauspost/compress/releases/tag/v1.20.2","tags":["article"]},{"url":"https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116689","tags":["advisory"]},{"url":"https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","tags":["article"]},{"url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2","tags":["article"]},{"url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-110289","title":"Git Sync connections send credentials to unvalidated server URLs","description":"A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).","status":"published","published":"2026-11-11T15:03:27.711Z","modified":"2026-11-11T15:03:27.711Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-11T16:29:57.175584Z"}],"euvd":[{"id":"EUVD-2026-123547","description":"A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).","status":"published","published":"2026-11-11T15:03:27Z","modified":"2026-11-11T15:03:27Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T17:29:39.353655Z"}],"ghsa":[{"id":"GHSA-97fx-j86f-w2rp","title":"A user with the Organization Admin role could point the server or token URL of a Git Sync...","description":"A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).","status":"published","published":"2026-11-11T15:31:04Z","modified":"2026-11-11T15:31:05Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-11T15:34:47.187237Z"}],"nvd":[{"id":"CVE-2026-110289","description":"A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).","status":"published","published":"2026-11-11T15:17:14.23Z","modified":"2026-11-12T19:09:06.967Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-11T17:25:38.53844Z"}],"osv":[{"id":"RHSA-2026:93601","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"withdrawn","published":"2026-11-13T18:49:07Z","modified":"2026-11-14T13:00:38.86740705Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-14T13:28:49.333691Z"}]}}