CVE-2026-79656

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.5 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2026-79656

Configurations

No configuration.

History

28 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-28 18:17

Updated : 2026-10-29 15:29

NVD link : CVE-2026-79656

Mitre link : CVE-2026-79656

CVE.ORG link : CVE-2026-79656

JSON object : View

Products Affected

No product.

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-79656", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.5}]}, "affected": [{"source": "security@grafana.com", "affectedData": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.11", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.9", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.6", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.11", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.9", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.6", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-28T18:17:20.270", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-79656", "source": "security@grafana.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@grafana.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client."}], "lastModified": "2026-10-29T15:29:45.363", "sourceIdentifier": "security@grafana.com"}