EUVD-2026-98902
GHSA-w2wx-887f-65f8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAdmin configures Git Sync to attacker-controlled Git server
-
DeliveryGrafana initiates provisioning fetch
-
ExploitMalicious server returns oversized/highly-compressed response
-
ExecutionGrafana buffers/decompresses unbounded data
-
ImpactMemory exhausted, instance denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that a Grafana administrator has explicitly enabled and configured the Git Sync (provisioning) feature to use the Git server under attacker control - this is not a default configuration. The attacker must control or compromise that configured Git server so it can return an oversized or highly compressed response to Grafana's provisioning fetch. Limiting factors: Grafana instances without Git Sync configured are not exploitable; the feature must point at an untrusted/attacker-influenced server; impact is limited to availability (memory exhaustion / DoS) with no confidentiality or integrity effect. |
| Impact | This is a genuine-but-moderate issue, correctly rated medium (CVSS 5.3). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) shows an availability-only impact with no confidentiality or integrity loss - a memory-exhaustion denial of service, not code execution or data compromise. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. CONFLICT TO VERIFY: the CVSS marks PR:N (no privileges) and AC:L (low complexity), but the description explicitly states exploitation 'requires an administrator to have configured Git Sync with that server' - i.e., a privileged administrator must first point Grafana's Git Sync provisioning at the attacker-controlled or compromised Git server. The true attacker is the operator of that Git server, and the attack only works against a non-default, deliberately-configured feature, which makes AC:L optimistic and materially lowers real-world risk below what AV:N/AC:L/PR:N alone implies. Net: low priority for environments not using Git Sync; a patch-soon item for those that have configured Git Sync against untrusted or externally-hosted Git servers. |
| Exploit ScenarioDerived | An organization configures Grafana's Git Sync provisioning to pull dashboards/config from a Git server. If that server is attacker-controlled or compromised, it responds to Grafana's fetch with an oversized or highly compressed (decompression-bomb-style) payload. Grafana attempts to buffer/decompress the response, exhausting available memory and crashing or rendering the instance unresponsive. No public exploit code was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Memory exhaustion in Grafana's Git Sync (provisioning) feature allows a Git server under attacker control to drive Grafana into uncontrolled resource consumption by returning oversized or highly compressed responses during a provisioning fetch. Grafana OSS, Grafana Enterprise, and the grafana/nanogit client library are affected, but only instances where an administrator has explicitly enabled Git Sync and pointed it at an attacker-influenced Git server are exploitable - this is not a default configuration. Impact is availability-only (memory exhaustion / denial of service) with no confidentiality or integrity effect; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 medium), and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch or fixed version is identified in the provided intelligence; the authoritative source for patch status and upgrade guidance is the Grafana advisory at https://grafana.com/security/security-advisories/cve-2026-95502, which should be consulted before assuming a fix exists for a given release line. Until a patched build is confirmed for your version, apply compensating controls that remove or constrain the attacker's control over the Git endpoint: if Git Sync is not operationally required, disable it entirely (side effect: loss of Git-based provisioning workflows and any automation depending on them); if it is required, point it only at a Git server fully controlled by your organization and never at third-party, shared, or untrusted repositories (side effect: reduces flexibility to use external providers). Where the Git host is self-managed, enforce a maximum response body size and disable or limit compressed transfer encodings at the reverse proxy or Git front end so oversized or compression-amplified payloads are rejected before reaching the Git client (side effect: may break legitimate repositories that rely on large or compressed transfers, and does not protect instances pointing at external providers). Additionally, constrain Grafana's outbound network access to only the known Git host via egress firewall or network policy (side effect: breaks Git Sync configurations that legitimately span multiple hosts), cap the Grafana process/container with cgroup memory limits and an OOM-restart policy so exhaustion is contained to Grafana rather than destabilizing the node (side effect: Grafana itself will be killed or restarted during an attack, so availability is degraded even when the blast radius is contained), and monitor Grafana memory usage and provisioning fetch errors for signs of an anomalous Git server response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-770, Allocation of Resources Without Limits or Throttling. Grafana's Git Sync provisioning feature uses the grafana/nanogit Git client library to fetch repository content over the network from a configured Git server; the client processes server-supplied responses without adequately bounding the amount of memory consumed. A malicious or compromised Git server can therefore return an extremely large response body, or a small but highly compressed payload that expands to a very large size when decompressed by the client (a decompression-style amplification), causing the Grafana process to allocate memory without limit and terminate or become unresponsive. The published vector rates AC:L while the independent assessment rates AC:H, reflecting that the attack is not simply 'send a request' - the attacker must already control or compromise the Git server that an administrator deliberately configured for Git Sync, and must be positioned to answer Grafana's provisioning fetches. The CPE data lists grafana:nanogit, grafana:grafana_oss, and grafana:grafana_enterprise with wildcard version fields, so the precise affected version ranges are not enumerated in the supplied intelligence and must be read from the vendor advisory.
Know when Grafana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable DoS, but exploitation depends on the non-default precondition that an admin configured Git Sync to the malicious server, so AC:H; availability-only, so C:N/I:N and A:L.
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
Lifecycle Timeline
2DescriptionCVE.org
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Exploit-DB