CVE-2026-8609 - Vulnerability Details - OpenCVE

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://grafana.com/security/security-advisories/cve-2026-8609

History

Fri, 10 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 10 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Title		Pre-authentication denial of service via the OAuth login route
Weaknesses		CWE-400
References		https://grafana.com/security/security-advisories/cve-2026-8609
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published: 2026-07-10T14:58:33.522Z

Updated: 2026-07-10T18:44:43.842Z

Reserved: 2026-05-14T16:01:42.297Z

Link: CVE-2026-8609

Vulnrichment

Updated: 2026-07-10T15:53:27.882Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8609", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-05-14T16:01:42.297Z", "datePublished": "2026-07-10T14:58:33.522Z", "dateUpdated": "2026-07-10T18:44:43.842Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-07-10T18:44:43.842Z"}, "datePublic": "2026-06-09T00:00:00.000Z", "title": "Pre-authentication denial of service via the OAuth login route", "descriptions": [{"lang": "en", "value": "An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service)."}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "defaultStatus": "unaffected", "versions": [{"version": "11.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"version": "12.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"version": "12.3.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"version": "12.4.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"version": "13.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.0.1"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-400", "cweId": "CWE-400", "type": "CWE"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-8609", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "credits": [{"lang": "en", "value": "cyberjoker (Researcher)", "type": "finder"}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T15:53:40.169487Z", "id": "CVE-2026-8609", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T15:53:51.365Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8609", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-05-14T16:01:42.297Z", "datePublished": "2026-07-10T14:58:33.522Z", "dateUpdated": "2026-07-10T15:53:51.365Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-07-10T15:40:09.547Z"}, "datePublic": "2026-06-09T00:00:00.000Z", "title": "Pre-authentication denial of service via the OAuth login route", "descriptions": [{"lang": "en", "value": "An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service)."}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "defaultStatus": "unaffected", "versions": [{"version": "11.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"version": "12.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"version": "12.3.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"version": "12.4.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"version": "13.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.0.1"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-400", "cweId": "CWE-400", "type": "CWE"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-8609", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "credits": [{"lang": "en", "value": "cyberjoker (Researcher)", "type": "finder"}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8609", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T15:53:40.169487Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T15:53:27.882Z"}}]}}