CVE-2026-79656
Description
A flaw was found in Grafana. When a user signs in using generic OAuth, Google, or GitLab single sign-on connectors, Grafana may write the user's OAuth or OpenID Connect (OIDC) tokens to its server logs in plaintext. This occurs if the identity provider returns an opaque token or if token parsing fails. A local attacker with read access to the Grafana server logs could recover these live credentials, which are scoped to the Grafana OAuth client. This vulnerability is not remotely exploitable and does not directly lead to account takeover.
Statement
This flaw is rated Moderate because it requires local access to Grafana server logs to exploit. While sensitive OAuth and OIDC tokens may be written to logs under specific SSO configurations, the vulnerability is not remotely exploitable, and the impact is limited by the scopes granted to the Grafana OAuth client, preventing direct account takeover.
Mitigation
To mitigate this issue, restrict read access to Grafana server logs and any downstream log pipelines. Additionally, minimize the scopes granted to the Grafana OAuth client to limit the potential impact of leaked tokens. If your identity provider issues long-lived or non-expiring tokens, consider rotating the Grafana OAuth client secret and revoking issued tokens at the provider.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 6 |
| Attack Vector | Network | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Storing a plaintext password in a configuration file allows anyone who can read the file to access the password-protected resource. In some contexts, even storage of a plaintext password in memory is considered a security risk if the password is not cleared immediately after it is used.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
