Bug 2528700 (CVE-2026-79656)

Summary: CVE-2026-79656 grafana: OAuth and OIDC tokens written unredacted to Grafana server logs
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, jbalunas, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, security-response-team, sfeifer, sostapov, tsze, vereddy, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Grafana. When a user signs in using generic OAuth, Google, or GitLab single sign-on connectors, Grafana may write the user's OAuth or OpenID Connect (OIDC) tokens to its server logs in plaintext. This occurs if the identity provider returns an opaque token or if token parsing fails. A local attacker with read access to the Grafana server logs could recover these live credentials, which are scoped to the Grafana OAuth client. This vulnerability is not remotely exploitable and does not directly lead to account takeover.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2564433    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-04 16:27:07 UTC 
Short description of the vulnerability: 

When a user signs in through the generic OAuth, Google, or GitLab single sign-on connectors, Grafana wrote the user's OAuth or OIDC tokens to its server log in plaintext if the identity provider returned a non-JWT (opaque) token or if token parsing failed. With the generic OAuth connector this happened at the default log level, and some of those log lines also contained the refresh token and the ID token. Anyone able to read the Grafana server logs, or the log pipeline they are shipped to, could recover live credentials scoped to the Grafana OAuth client. This is not remotely exploitable and does not by itself allow account takeover; the impact is bounded by the scopes granted to that OAuth client. The azuread, github, okta, and grafana.com connectors are not affected. 

Known mitigations: 

Update to one of the private builds listed above. Until you have updated, reduce exposure by restricting read access to Grafana server logs and any downstream log pipeline, shortening log retention, and minimising the scopes granted to the Grafana OAuth client. If your identity provider issues long-lived or non-expiring tokens, rotate the Grafana OAuth client secret and revoke issued tokens at the provider. 

Affected products and versions: 

Grafana OSS and Grafana Enterprise: 12.2.0 to 12.2.11, 12.3.0 to 12.3.11, 12.4.0 to 12.4.9, 13.0.0 to 13.0.7, 13.1.0 to 13.1.4, and 13.2.0.