Token Exposure in Grafana by Grafana Labs
CVE-2026-79656

6MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Oss
Grafana Enterprise
Vendor
CVE Published:
28 October 2026

What is CVE-2026-79656?

The vulnerability allows a user with read access to Grafana's server logs, or to a log store receiving these logs, to potentially recover sensitive OAuth and OIDC tokens. This happens particularly when tokens are logged unredacted due to invalid format or missing ID tokens during logging processes. Users signing in through Generic OAuth, Google, or GitLab may be at risk if appropriate log security measures are not enforced. The exposure risk correlates with the scopes granted to the configured OAuth client, highlighting the need for robust access controls and logging practices.

Affected Version(s)

Grafana Enterprise 0 <= 12.3.11

Grafana Enterprise 12.4.0 < 12.4.11

Grafana Enterprise 13.0.0 < 13.0.9

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Baptiste Roux (baprx)
.