---
id: "CVE-2026-79656"
kind: "vulnerability"
aliases: ["CVE-2026-79656"]
title: "Grafana: server logs can leak OAuth and OIDC tokens to log readers"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["grafana", "logging", "oauth", "runtime", "self-hosted"]
not_affected_if: ["local-login-only", "no-oauth-providers"]
published_at: "2026-10-28T18:17:20+00:00"
first_seen_at: "2026-10-28T18:34:34+00:00"
updated_at: "2026-10-28T18:35:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79656", "first_seen_at": "2026-10-28T18:34:34+00:00"}]
---

# Grafana: server logs can leak OAuth and OIDC tokens to log readers

Grafana writes OAuth and OIDC access, refresh and ID tokens to its server logs unredacted in some failure cases with the Generic OAuth, Google and GitLab providers. Anyone who can read those logs or the log store they are shipped to can recover the tokens and act with the scopes granted to the OAuth client.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Grafana version with `grafana server -v` or the About page in the UI.
- Confirm whether OAuth login is enabled under `[auth.generic_oauth]`, `[auth.google]` or `[auth.gitlab]` in grafana.ini.
- Search shipped logs for token-like strings, for example JWT values beginning `eyJ`, in the Grafana log stream.

## Fix

- Upgrade Grafana to a patched release; the exact fixed version is unknown from the sources.
- Rotate OAuth client secrets and revoke sessions if tokens may have been exposed in logs.
- Restrict read access to Grafana logs and downstream log stores to those who need it.

## Timeline

- 2026-10-28T18:34:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79656

## From the sources

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_