grafana-gitsync-dns-rebind

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · grafana-gitsync-dns-rebind Write-up: https://abraxaslabs.tech/research/grafana-gitsync-dns-rebind grafana-gitsync-dns-rebind Class: SSRF Reach: Remote Grafana OSS 13.2.3 6193dc0 - Grafana Labs Git Sync URLValidator...

Gopass path traversal vulnerability

Versions of Gopass prior to 1.17.0 contain a path traversal vulnerability. This vulnerability stems from improper handling of paths in the file system backend. Attackers can exploit the ../ entries in Prune and IsDir to gain write access to shared Git sync storage, thereby creating specially...

grafana: Grafana: Unauthorized configuration modification via status subresource

A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...

grafana: grafana: Denial of Service via oversized Git Sync responses

A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service DoS condition on the Grafana...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: git-sync: git-sync-4.7.1-0.3.hum1 aarch64, s390x, x8664 git-sync-4.7.1-0.3.hum1.src src Security Fixes: git-sync: CVE-2026-111943...

Linux Distros Unpatched Vulnerability : CVE-2026-15577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource...

Linux Distros Unpatched Vulnerability : CVE-2026-95502

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Git server that Grafana's Git Sync provisioning is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses...

BIT-GRAFANA-2026-15577 Git Sync connection configuration can be modified with read-only access

A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource incorrect authorization. On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled...

grafana: grafana: Denial of Service via oversized Git Sync responses

A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service DoS condition on the Grafana...

grafana: Grafana: Unauthorized configuration modification via status subresource

A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...

grafana: Grafana: Unauthorized configuration modification via status subresource

A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...

SUSE CVE-2026-15577

A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource incorrect authorization. On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled...

SUSE CVE-2026-95502

A Git server that Grafana's Git Sync provisioning is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses uncontrolled resource consumption. Exploitation requires an administrator to have configured Git Sync with that server...

CVE-2026-15577

A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...

CVE-2026-95502

A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service DoS condition on the Grafana...

CVE-2026-95502

A Git server that Grafana's Git Sync provisioning is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses uncontrolled resource consumption. Exploitation requires an administrator to have configured Git Sync with that server...

CVE-2026-15577

A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource incorrect authorization. On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled...

CVE-2026-95502 Git Sync memory exhaustion via a malicious Git server

A Git server that Grafana's Git Sync provisioning is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses uncontrolled resource consumption. Exploitation requires an administrator to have configured Git Sync with that server...

EUVD-2026-98902

A Git server that Grafana's Git Sync provisioning is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses uncontrolled resource consumption. Exploitation requires an administrator to have configured Git Sync with that server...

EUVD-2026-98904

A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource incorrect authorization. On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled...