Live › vulnerability › CVE-2026-79656
Go to dashboardGrafana writes OAuth and OIDC access, refresh and ID tokens to its server logs unredacted in some failure cases with the Generic OAuth, Google and GitLab providers. Anyone who can read those logs or the log store they are shipped to can recover the tokens and act with the scopes granted to the OAuth client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Deployments that sign users in through Generic OAuth, Google or GitLab and that ship Grafana server logs to a store others can read. The exposure is limited to the scopes granted to the configured OAuth client. Teams that use only local accounts or other login methods can skip it.
No product ranges from the sources yet.
grafana server -v or the About page in the UI.[auth.generic_oauth], [auth.google] or [auth.gitlab] in grafana.ini.eyJ, in the Grafana log stream.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
This page as .md · .json · in your agent: get_signal("CVE-2026-79656")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.