{"id":"CVE-2026-79656","kind":"vulnerability","aliases":["CVE-2026-79656"],"related":[],"title":"Grafana: server logs can leak OAuth and OIDC tokens to log readers","description":"A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.","summary":"Grafana writes OAuth and OIDC access, refresh and ID tokens to its server logs unredacted in some failure cases with the Generic OAuth, Google and GitLab providers. Anyone who can read those logs or the log store they are shipped to can recover the tokens and act with the scopes granted to the OAuth client.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grafana","logging","oauth","runtime","self-hosted"],"not_affected_if":["local-login-only","no-oauth-providers"],"how_to_check":"- Check the Grafana version with `grafana server -v` or the About page in the UI.\n- Confirm whether OAuth login is enabled under `[auth.generic_oauth]`, `[auth.google]` or `[auth.gitlab]` in grafana.ini.\n- Search shipped logs for token-like strings, for example JWT values beginning `eyJ`, in the Grafana log stream.","fix":"- Upgrade Grafana to a patched release; the exact fixed version is unknown from the sources.\n- Rotate OAuth client secrets and revoke sessions if tokens may have been exposed in logs.\n- Restrict read access to Grafana logs and downstream log stores to those who need it.","status":"open","published_at":"2026-10-28T18:17:20+00:00","first_seen_at":"2026-10-28T18:34:34+00:00","triaged_at":"2026-10-28T18:35:05+00:00","updated_at":"2026-10-28T18:35:05+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T18:35:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Grafana to a patched release; the exact fixed version is unknown from the sources.\n- Rotate OAuth client secrets and revoke sessions if tokens may have been exposed in logs.\n- Restrict read access to Grafana logs and downstream log stores to those who need it.","reach":"local","title":"Grafana: server logs can leak OAuth and OIDC tokens to log readers","impact":"medium","summary":"Grafana writes OAuth and OIDC access, refresh and ID tokens to its server logs unredacted in some failure cases with the Generic OAuth, Google and GitLab providers. Anyone who can read those logs or the log store they are shipped to can recover the tokens and act with the scopes granted to the OAuth client.","category":"runtime","nicknames":[],"who_cares":["grafana","self-hosted","oauth","logging"],"confidence":0.6,"needs_auth":"yes","worst_case":"OAuth and OIDC tokens readable from logs, enabling account impersonation within granted scopes","analyst_note":"Sources do not name the patched Grafana versions or the affected version range; check the NVD entry and Grafana's security advisory for fixed releases.","how_to_check":"- Check the Grafana version with `grafana server -v` or the About page in the UI.\n- Confirm whether OAuth login is enabled under `[auth.generic_oauth]`, `[auth.google]` or `[auth.gitlab]` in grafana.ini.\n- Search shipped logs for token-like strings, for example JWT values beginning `eyJ`, in the Grafana log stream.","needs_analyst":true,"not_affected_if":["local-login-only","no-oauth-providers"],"who_is_affected":"Deployments that sign users in through Generic OAuth, Google or GitLab and that ship Grafana server logs to a store others can read. The exposure is limited to the scopes granted to the configured OAuth client. Teams that use only local accounts or other login methods can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":3386,"output_tokens":716,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-79656':15A,18A 'access':31B,85C,106C,134C 'act':72B 'anyon':53B 'bound':167C 'case':44B 'client':80B,176C 'configur':174C 'cve':13A,16A 'debug':150C 'exposur':157C,165C 'failur':43B 'file':163C 'generic':47B,118C 'gitlab':51B,122C 'googl':49B,120C 'grafana':1A,19B,26B,87C,124C 'grant':76B,171C 'host':25B 'id':34B,109C,136C,145C 'inform':160C 'jwt':142C 'leak':5A 'level':151C 'log':3A,11A,20B,39B,58B,61B,90C,94C,130C,162C 'miss':148C 'oauth':6A,21B,28B,48B,79B,103C,119C,175C 'oidc':8A,30B,105C 'provid':52B,123C 'read':56B,84C 'reader':12A 'recov':68B,101C 'refresh':32B,107C 'runtim':22B 'scope':75B,170C 'self':24B 'self-host':23B 'sensit':159C 'server':2A,38B,89C 'ship':65B,98C 'sign':114C 'store':62B,95C 'string':156C 'token':9A,35B,70B,110C,127C,137C,146C 'unredact':40B,131C 'user':82C,112C 'valid':141C 'write':27B,125C","nicknames":[],"mitigations":[],"who_affected":"Deployments that sign users in through Generic OAuth, Google or GitLab and that ship Grafana server logs to a store others can read. The exposure is limited to the scopes granted to the configured OAuth client. Teams that use only local accounts or other login methods can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79656","severity":null,"published_at":"2026-10-28T18:17:20+00:00","modified_at":"2026-10-28T18:17:20+00:00","first_seen_at":"2026-10-28T18:34:34+00:00","fetched_at":"2026-10-28T18:34:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}