Grafana: OAuth and OIDC access, refresh and ID tokens written unredacted to server logs

Impact

When an access or ID token from the Generic OAuth, Google or GitLab providers is not a valid JWT, is missing, or is not a string, Grafana logs the access, refresh and ID tokens verbatim. Anyone who can read Grafana's logs - or the Loki/Elasticsearch/S3 store they are shipped to - can lift live tokens for users who signed in and act as them against the identity provider, bounded by the scopes granted to Grafana's OAuth client. In a datacenter this matters because log stores are usually readable by a far wider group than Grafana admins (SRE, on-call, anyone with a logs datasource), and if the OAuth client carries broad scopes those tokens can reach the operator's wider SSO estate, not just dashboards. Refresh tokens stay useful until revoked, so the exposure outlives log rotation.

Who can reach it

No remote exploit step: it needs read access to Grafana's own log output or to the downstream log store. The record scores it local with high privilege required. Practically, any engineer or service account with access to the logging pipeline.

What to do

Upgrade to the Grafana release named in the vendor advisory (versions are not in this record - see grafana.com/security/security-advisories/cve-2026-79656) and restart the Grafana service. Then treat already-written logs as credential material: purge or restrict the affected log ranges in the log store, and have the identity provider revoke OAuth refresh tokens for users who signed in through the affected providers, so logged tokens cannot be replayed. Tightening read access on the log store is the useful interim mitigation. No GPU node is touched.

References

Related entries

• AMD NBIO register lock bits - MMIO routing configuration: The sibling of the SMN issue: unprotected NBIO lock bits letCVE-2025-61971 · AMD NBIO register lock bits - MMIO routing configurationMedium
• Jenkins Eggplant Runner Plugin: clears a JVM-wide proxy protection, exposing Basic credentials over HTTPS tunnelsCVE-2025-64135 · Jenkins Eggplant Runner Plugin (jdk.http.auth.tunneling.disabledSchemes)Medium
• ansible-runner: streamed archive extraction follows symlinks and writes outside the target directoryCVE-2026-103754 · ansible-runner (unstream_dir() in the transmit/worker protocol)Medium
• nfs-utils rpc.statd: memory leak on state notification requests lets a remote attacker exhaust node memoryCVE-2026-89096 · nfs-utils rpc.statd (NSM state notification callback handling)Medium
• GitLab: improper redirect validation in the Kubernetes proxy sends cluster auth tokens to an attacker-chosen serverCVE-2026-7767 · GitLab CE/EE (Kubernetes agent proxy redirect validation)Medium
• DMTF libspdm - SPDM Requester timeout handling: A libspdm Requester stores the Responder's CTExponentCVE-2023-32690 · DMTF libspdm - SPDM Requester timeout handlingMedium