All vulnerabilities
CVE-2026-79656

Grafana OSS: OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors

Grafana Grafana OSSApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in12.4.11Also 13.0.9, 13.1.6 and 1 moreCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.

Text from CVE List

Affected versions 10

  • Grafana OSSaffected: all versions through 12.3.11CVE List
  • Grafana OSSaffected: 12.4.0 before 12.4.11CVE List
  • Grafana OSSaffected: 13.0.0 before 13.0.9CVE List
  • Grafana OSSaffected: 13.1.0 before 13.1.6CVE List
  • Grafana OSSaffected: 13.2.0 before 13.2.2CVE List
  • Grafana Enterpriseaffected: all versions through 12.3.11CVE List
  • Grafana Enterpriseaffected: 12.4.0 before 12.4.11CVE List
  • Grafana Enterpriseaffected: 13.0.0 before 13.0.9CVE List
  • Grafana Enterpriseaffected: 13.1.0 before 13.1.6CVE List
  • Grafana Enterpriseaffected: 13.2.0 before 13.2.2CVE List

References 1