CVE-2026-95502
Nanogit: Git Sync memory exhaustion via a malicious Git server
Grafana NanogitApplications & CMS
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.7.0NanogitCVE List
- 13.0.11Grafana OSSCVE List
- 13.1.8Grafana OSSCVE List
- 13.2.4Grafana OSSCVE List
- 13.0.11Grafana EnterpriseCVE List
- 13.1.8Grafana EnterpriseCVE List
Show all 7 fixed versions
- 13.2.4Grafana EnterpriseCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Text from CVE List
Affected versions 7
- Nanogitaffected: all versions before 1.7.0CVE List
- Grafana OSSaffected: 13.0.0 before 13.0.11CVE List
- Grafana OSSaffected: 13.1.0 before 13.1.8CVE List
- Grafana OSSaffected: 13.2.0 before 13.2.4CVE List
- Grafana Enterpriseaffected: 13.0.0 before 13.0.11CVE List
- Grafana Enterpriseaffected: 13.1.0 before 13.1.8CVE List
- Grafana Enterpriseaffected: 13.2.0 before 13.2.4CVE List