Описание
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
A flaw was found in Grafana. When a user signs in using generic OAuth, Google, or GitLab single sign-on connectors, Grafana may write the user's OAuth or OpenID Connect (OIDC) tokens to its server logs in plaintext. This occurs if the identity provider returns an opaque token or if token parsing fails. A local attacker with read access to the Grafana server logs could recover these live credentials, which are scoped to the Grafana OAuth client. This vulnerability is not remotely exploitable and does not directly lead to account takeover.
Отчет
This flaw is rated Moderate because it requires local access to Grafana server logs to exploit. While sensitive OAuth and OIDC tokens may be written to logs under specific SSO configurations, the vulnerability is not remotely exploitable, and the impact is limited by the scopes granted to the Grafana OAuth client, preventing direct account takeover.
Меры по смягчению последствий
To mitigate this issue, restrict read access to Grafana server logs and any downstream log pipelines. Additionally, minimize the scopes granted to the Grafana OAuth client to limit the potential impact of leaked tokens. If your identity provider issues long-lived or non-expiring tokens, consider rotating the Grafana OAuth client secret and revoking issued tokens at the provider.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Fix deferred | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Fix deferred | ||
| Red Hat Ceph Storage 7 | rhceph/grafana-rhel9 | Fix deferred | ||
| Red Hat Ceph Storage 8 | rhceph/grafana-rhel9 | Fix deferred | ||
| Red Hat Ceph Storage 9 | rhceph/grafana-rhel10 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | grafana | Fix deferred | ||
| Red Hat Enterprise Linux 10 | rhel10/grafana | Fix deferred | ||
| Red Hat Enterprise Linux 8 | grafana | Fix deferred | ||
| Red Hat Enterprise Linux 9 | grafana | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rhel9/grafana | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
EPSS
5.9 Medium
CVSS3