Log in Start free

Vulnerability · Published Oct 28, 2026 · Assigned by GRAFANA

CVE-2026-79656OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors

Medium 6.0

In plain English

A medium-severity sensitive data in logs in Grafana Enterprise from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.0Medium
Exploit odds (30 days)0.2%top 94.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24grafana12.4.14-r0ALPINE-CVE-2026-79656

Affected products (as reported)

VendorProductVersions
Grafana Grafana OSS 0 – through 12.3.1112.4.0 – before 12.4.1113.0.0 – before 13.0.913.1.0 – before 13.1.613.2.0 – before 13.2.2
Grafana Grafana Enterprise 0 – through 12.3.1112.4.0 – before 12.4.1113.0.0 – before 13.0.913.1.0 – before 13.1.613.2.0 – before 13.2.2

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References