CVE-2026-79656
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
CVSS Score
6.0
EPSS Score
0.0%
EPSS Percentile
0th
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
| CWE | CWE-532 |
| Vendor | grafana |
| Product | grafana oss |
| Ecosystems | |
| Industries | Technology |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for grafana grafana oss
Be the first to know when new medium vulnerabilities affecting grafana grafana oss are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Grafana / Grafana OSS
0 ≤ 12.3.11 12.4.0 < 12.4.11 13.0.0 < 13.0.9 13.1.0 < 13.1.6 13.2.0 < 13.2.2
Grafana / Grafana Enterprise
0 ≤ 12.3.11 12.4.0 < 12.4.11 13.0.0 < 13.0.9 13.1.0 < 13.1.6 13.2.0 < 13.2.2
References
Credits
Baptiste Roux (baprx)