IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
6.0Orta

CVE-2026-79656OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors

Grafana Grafana OSS; Grafana Grafana Enterprise Yayım: (13 gün önce)

Açıklama

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.

Zayıflık türü (CWE): CWE-532

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Grafana Grafana Enterprise ≤ 12.3.11, 12.4.0 – < 12.4.11, 13.0.0 – < 13.0.9, 13.1.0 – < 13.1.6, 13.2.0 – < 13.2.2
Grafana Grafana OSS ≤ 12.3.11, 12.4.0 – < 12.4.11, 13.0.0 – < 13.0.9, 13.1.0 – < 13.1.6, 13.2.0 – < 13.2.2

Kaynaklar ve yamalar

Aynı üründe son açıklar — Grafana

8.5Yüksek
CVE-2026-33379

Dashboard snapshot permission bypass

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13…

8.9Yüksek
CVE-2026-103506

SSO settings authorization bypass

Grafana Grafana Enterprise; Grafana Grafana OSS

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettings…

6.5Orta
CVE-2026-88858

Server-side expression parser denial of service

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

7.7Yüksek
CVE-2026-88967

Azure Monitor access token disclosure via SSRF

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

7.7Yüksek
CVE-2026-100105

Alerting contact point authorization bypass via schema downgrade

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…

6.5Orta
CVE-2026-16491

CVE-2026-16491 CVE Record

Grafana Grafana Enterprise; Grafana Grafana OSS

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of ever…