CVE-2026-79656

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-79656", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-08-25T11:00:05.466Z", "datePublished": "2026-10-28T17:23:44.625Z", "dateUpdated": "2026-11-05T16:56:30.314Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "12.4.11", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.9", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.6", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.2", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "12.4.11", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.9", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.6", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.2", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Baptiste Roux (baprx)"}], "datePublic": "2026-09-15T12:21:32.000Z", "descriptions": [{"lang": "en", "value": "A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client."}], "metrics": [{"cvssV3_1": {"baseScore": 6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-28T17:23:44.625Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-79656"}], "source": {"discovery": "EXTERNAL_REPORT"}, "title": "OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:53:21.326563Z", "id": "CVE-2026-79656", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:56:30.314Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-79656", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T16:53:21.326563Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:56:23.411Z"}}], "cna": {"title": "OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors", "source": {"discovery": "EXTERNAL_REPORT"}, "credits": [{"lang": "en", "type": "finder", "value": "Baptiste Roux (baprx)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.11", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.9", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.6", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.11", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.9", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.6", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-09-15T12:21:32.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-79656", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-28T17:23:44.625Z"}}}, "cveMetadata": {"cveId": "CVE-2026-79656", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:56:30.314Z", "dateReserved": "2026-08-25T11:00:05.466Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-10-28T17:23:44.625Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "12.4.11", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.9", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.6", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.2", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "12.4.11", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.9", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.6", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.2", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client."}], "id": "CVE-2026-79656", "lastModified": "2026-11-05T17:18:20.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 4.0, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-79656", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:53:21.326563Z", "version": "2.0.3"}}]}, "published": "2026-10-28T18:17:20.270", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-79656"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: OAuth and OIDC tokens written unredacted to Grafana server logs", "id": "2528700", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528700"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-256", "details": ["A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.", "A flaw was found in Grafana. When a user signs in using generic OAuth, Google, or GitLab single sign-on connectors, Grafana may write the user's OAuth or OpenID Connect (OIDC) tokens to its server logs in plaintext. This occurs if the identity provider returns an opaque token or if token parsing fails. A local attacker with read access to the Grafana server logs could recover these live credentials, which are scoped to the Grafana OAuth client. This vulnerability is not remotely exploitable and does not directly lead to account takeover."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict read access to Grafana server logs and any downstream log pipelines. Additionally, minimize the scopes granted to the Grafana OAuth client to limit the potential impact of leaked tokens. If your identity provider issues long-lived or non-expiring tokens, consider rotating the Grafana OAuth client secret and revoking issued tokens at the provider."}, "name": "CVE-2026-79656", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rhel10/grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rhel9/grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/grafana", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-29T13:02:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-79656\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-79656"], "statement": "This flaw is rated Moderate because it requires local access to Grafana server logs to exploit. While sensitive OAuth and OIDC tokens may be written to logs under specific SSO configurations, the vulnerability is not remotely exploitable, and the impact is limited by the scopes granted to the Grafana OAuth client, preventing direct account takeover.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,12.3.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,12.3.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana Enterprise", "source": "cna", "vendor": "Grafana"}, "product": "grafana_enterprise", "vendor": "grafana"}], "created": "2026-10-28T19:00:23.216802+00:00", "updated": "2026-10-30T02:45:07.614172+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana", "grafana$PRODUCT$grafana_enterprise"]}