CVE-2026-8609 | An unauthenticated attacker can repeatedly call Grafana's OA… | CVSS 5.3 MEDIUM

Description

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

Metadata

CVE ID: CVE-2026-8609
State: PUBLISHED
Assigner: GRAFANA
Reserved: 2026-05-14 16:01 UTC
Published: 2026-07-10 14:58 UTC
Last updated: 2026-07-10 18:44 UTC
Primary CWE: CWE-400
CWE-400
Vendor / Product: Grafana / Grafana OSS
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Grafana	Grafana OSS	—	11.6.0 ≤ 11.6.14, 12.2.0 ≤ 12.2.8, 12.3.0 ≤ 12.3.6, 12.4.0 ≤ 12.4.3 …

Weakness (CWE)

CWE	Source	Description
CWE-400	cna	CWE-400
CWE-400	adp	CWE-400 Uncontrolled Resource Consumption

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References (1)

https://grafana.com/security/security-advisories/cve-2026-8609