CVE WatchOct 28, 2026

CVE-2026-79656

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and

CVSS

6.0

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 28, 2026 · Last modified: Oct 28, 2026 · CWE-532

EPSS · 30d

Not enough EPSS history yet.

Technical description

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.

Official references

grafana.comhttps://grafana.com/security/security-advisories/cve-2026-79656

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1186478.2 HIG

—

———n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.8h CVE-2026-1166916.5 MED

—

——0MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.12h CVE-2026-1083284.2 MED

—

——0Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.13h CVE-2026-1083256.6 MED

—

——0Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.13h CVE-2026-114409—

—

——0Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.1d CVE-2026-117341—

—

——0In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.2d