CVE-2026-79656

OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors

State: Published
Severity: 6.0 Medium
Published: Oct 28, 2026
Updated: Oct 28, 2026
Reserved: Aug 25, 2026

Description

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.

Scores

CVSS	Score	Vector	Source
3.1	6.0 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N	GRAFANA

Weaknesses

CWE-532

Affected Products

Product	Versions
Grafana OSSGrafana	12.3.11 and earlierAffected 12.4.0 to before 12.4.11Affected 13.0.0 to before 13.0.9Affected 13.1.0 to before 13.1.6Affected 13.2.0 to before 13.2.2Affected
Grafana EnterpriseGrafana	12.3.11 and earlierAffected 12.4.0 to before 12.4.11Affected 13.0.0 to before 13.0.9Affected 13.1.0 to before 13.1.6Affected 13.2.0 to before 13.2.2Affected

References

https://grafana.com/security/security-advisories/cve-2026-79656vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.