Description
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana OSS | ≤ 12.3.11, 12.4.0 – < 12.4.11, 13.0.0 – < 13.0.9, 13.1.0 – < 13.1.6, 13.2.0 – < 13.2.2 | 12.4.11 |
| Grafana | Grafana Enterprise | ≤ 12.3.11, 12.4.0 – < 12.4.11, 13.0.0 – < 13.0.9, 13.1.0 – < 13.1.6, 13.2.0 – < 13.2.2 | 12.4.11 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 12.4.11-1.1 | openSUSE-SU-2026:11920-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.14-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-12.3 | No fix yet | — |
Advisories 1
- openSUSE-SU-2026:11920-1 grafana-12.4.11-1.1 on GA media SUSE / openSUSE Security Updates · Sep 30, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-79656 vendor-advisory