Grafana EUVD-2026-112280

Exploitation requires the attacker to already have read access to Grafana's server logs, or to a downstream log store/SIEM those logs are shipped to - this is the core prerequisite (reflected as AV:L/PR:H). The sensitive data is written only under specific conditions: the deployment must authenticate users via the Generic OAuth, Google or GitLab providers, and the leak occurs when an access or ID token is not a valid JWT, when the ID token is missing (only at debug log level), or when the ID token is not a string. Limiting factors that reduce realistic risk: deployments not using these OAuth/OIDC providers are unaffected; the missing-ID-token path requires debug-level logging to be enabled; the value of recovered tokens is bounded by the scopes granted to the configured OAuth client; and the attacker needs standing privileged access to the logs rather than any network-facing entry point.

This is a moderate, contingent-risk issue rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.0) is internally consistent: exploitation is local (AV:L) and requires high privilege (PR:H) because the attacker must already hold read access to Grafana's server logs or to a downstream log store those logs are shipped to. That privilege gate - not a network path - is the dominant limiting factor. The scope change (S:C) with C:H reflects that the leaked artifacts are OAuth/OIDC access, refresh and ID tokens belonging to a separate security authority (the identity provider), so a successful read can impact systems beyond Grafana itself, bounded by the OAuth client's granted scopes. There is no integrity or availability impact (I:N/A:N). No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present - only the vendor advisory. The vuln.today priority is 'this_month', not act_now/emergency, consistent with the signals: real but not driven by observed widespread exploitation. Net: a genuine confidentiality defect that matters most where log read access is broad or logs are centralized to a SIEM with wider audiences, but it is gated behind privileged log access and depends on specific malformed-/missing-token conditions, so it is not a network-facing critical. Missing signals to state explicitly: EPSS probability is absent, and KEV/POC status is negative, so prioritization rests on vendor data plus the CVSS vector rather than any evidence of active exploitation.

An insider or compromised account with read access to Grafana server logs - or anyone able to query a centralized log store (e.g. a SIEM/ELK stack) that Grafana ships logs to - searches those logs and recovers OAuth/OIDC access, refresh and ID tokens for users who signed in via Generic OAuth, Google or GitLab. The attacker then replays those tokens against the identity provider or downstream APIs, limited to the scopes granted to the configured OAuth client. No public exploit identified at time of analysis; exploitation requires the pre-existing privileged log access reflected in CVSS AV:L/PR:H.