CVE-2026-79656

A flaw was found in Grafana. When a user signs in using generic OAuth, Google, or GitLab single sign-on connectors, Grafana may write the user's OAuth or OpenID Connect (OIDC) tokens to its server logs in plaintext. This occurs if the identity provider returns an opaque token or if token parsing fails. A local attacker with read access to the Grafana server logs could recover these live credentials, which are scoped to the Grafana OAuth client. This vulnerability is not remotely exploitable and does not directly lead to account takeover.

This flaw is rated Moderate because it requires local access to Grafana server logs to exploit. While sensitive OAuth and OIDC tokens may be written to logs under specific SSO configurations, the vulnerability is not remotely exploitable, and the impact is limited by the scopes granted to the Grafana OAuth client, preventing direct account takeover.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict read access to Grafana server logs and any downstream log pipelines. Additionally, minimize the scopes granted to the Grafana OAuth client to limit the potential impact of leaked tokens. If your identity provider issues long-lived or non-expiring tokens, consider rotating the Grafana OAuth client secret and revoking issued tokens at the provider.