CVE-2026-110289
MEDIUM
NVD
CVSS Score
5.5
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).