CVE-2026-95502— Git Sync memory exhaustion via a malicious Git server
Quick assessment
Affected
Grafana Nanogit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Grafana 的 Git Sync（配置预置）所配置使用的 Git 服务器，可能通过返回过大的或高度压缩的响应，导致 Grafana 的内存耗尽（不受控的资源消耗）。要利用此漏洞，需要管理员已将 Git Sync 配置为使用该 Git 服务器。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Grafana | Grafana Enterprise | 13.0.0< 13.0.11 |
affected |
13.1.0< 13.1.8 |
affected | ||
13.2.0< 13.2.4 |
affected | ||
| Grafana | Grafana OSS | 13.0.0< 13.0.11 |
affected |
13.1.0< 13.1.8 |
affected | ||
13.2.0< 13.2.4 |
affected | ||
| Grafana | Nanogit | < 1.7.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-95502
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Git Sync memory exhaustion via a malicious Git server
Source: CVE Program / CVE List V5
Vulnerability Description
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Grafana | Nanogit | 0 ~ 1.7.0 | - |
|
| Grafana | Grafana OSS | 13.0.0 ~ 13.0.11 | - |
|
| Grafana | Grafana Enterprise | 13.0.0 ~ 13.0.11 | - |
|
II. Public POCs for CVE-2026-95502
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-95502
请登录查看更多情报信息。
Other References for CVE-2026-95502 (1)
-
https://grafana.com/security/security-advisories/cve-2026-95502 vendor-advisory
Same Patch Batch · Grafana · 2026-10-13 · 4 CVEs total
| CVE-2026-33374 | 6.5 MEDIUM | Unbounded memory allocation in the Prometheus rule conversion API |
| CVE-2026-15577 | 6.5 MEDIUM | Git Sync connection configuration can be modified with read-only access |
| CVE-2026-93294 | 6.3 MEDIUM | Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager |
IV. Related Vulnerabilities
Same vendor: Grafana
-
CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arb -
CVE-2026-33374
Unbounded memory allocation in the Prometheus rule conversio -
CVE-2026-15577
Git Sync connection configuration can be modified with read- -
CVE-2026-89039
Arbitrary file read via the convert_playwright_script prompt -
CVE-2026-13720
Editor can forge file-provisioning provenance on dashboards
Same weakness: CWE-770
-
CVE-2026-88084
Microsoft SQL Server Denial of Service Vulnerability -
CVE-2026-96959
.NET Denial of Service Vulnerability -
CVE-2026-96300
RPC Endpoint Mapper Service Denial of Service Vulnerability -
CVE-2026-83645
Active Directory Federation Services (AD FS) Denial of Servi -
CVE-2026-70072
Windows Netlogon Denial of Service Vulnerability
V. Comments for CVE-2026-95502
No comments yet