CVE-2026-95502 in Grafana
Summary
by MITRE • 10/13/2026
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified involves a critical uncontrolled resource consumption flaw within the Git Sync feature of Grafana, specifically affecting its provisioning capabilities. This issue arises when Grafana is configured to synchronize configuration data from a remote Git repository via the Git Sync mechanism. The core technical deficiency lies in how the application handles responses received from the configured Git server during synchronization operations. Specifically, if the Git server returns an oversized response or one that utilizes highly compressed data formats without adequate limits on decompression size or memory allocation, Grafana fails to properly constrain resource usage. This lack of input validation and resource management allows a maliciously configured or compromised Git repository to trigger excessive memory consumption within the Grafana process. The vulnerability is classified under CWE-400, which denotes uncontrolled resource consumption, as the application does not enforce strict limits on the size of data it processes from external sources during automated synchronization tasks.
From an operational perspective, this flaw can lead to a denial-of-service condition for the affected Grafana instance. When the Git Sync process attempts to fetch and parse large or heavily compressed payloads, the memory footprint of the application grows uncontrollably until system resources are exhausted. This typically results in the Grafana service becoming unresponsive, crashing due to out-of-memory errors, or forcing a restart by container orchestration systems like Kubernetes if resource limits are hit. The impact is significant because it disrupts access to dashboards and monitoring data for all users relying on that instance. Furthermore, since this vulnerability requires an administrator to have explicitly configured Git Sync with the targeted server, exploitation relies on initial configuration trust or compromised administrative credentials rather than unauthenticated remote code execution. However, in environments where internal services are trusted but potentially misconfigured or attacked by insider threats, the risk remains substantial for service availability and integrity.
The attack vector aligns with ATT&CK technique T1496, which covers Resource Hijacking, as an attacker can leverage this flaw to consume computational resources effectively denying service to legitimate users. It also touches upon CWE-770, allocation of resources without limits or throttling, highlighting the absence of safeguards against excessive data processing. To mitigate this vulnerability, administrators should ensure they are running a patched version of Grafana that addresses these memory handling issues in the Git Sync module. Additionally, implementing network-level controls such as rate limiting and payload size restrictions on the Git server side can provide an additional layer of defense. It is also advisable to review Git Sync configurations to minimize exposure by restricting access to trusted repositories only and monitoring system resource usage for anomalies during synchronization cycles. Regular updates and adherence to security best practices for provisioning tools are essential to maintaining the resilience of Grafana deployments against such resource exhaustion attacks.