CVE-2026-8609Pre-authentication denial of service via the OAuth login route

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

7.5 HIGHEPSS 0.39%Not in KEVNVD: Analyzed

Last updated: 2026-10-25 15:10 UTC

OverviewCVSS details

7.5HIGHCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: Jul 10, 2026
Assigner: GRAFANA

Affected

Grafana OSS (Grafana)

Versions: 11.6.0 through 11.6.14 · 12.2.0 through 12.2.8

All affected versions →

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable yes · Impact partial

EPSS · FIRST, scored Nov 8

0.39%chance of exploitation in 30 days

Higher than 34.23% of CVEs

CVSS 3.1 · NVD

7.5High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: None
Integrity impact: None
Availability impact: High

CVSS 3.1 · GRAFANA (CNA)

5.3Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: None
Integrity impact: None
Availability impact: Low

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.5	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.3	MEDIUM	3.1GRAFANA (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CVE ID: CVE-2026-8609
Status: Analyzed
Assigner (CNA): GRAFANA
Published: Jul 10, 2026
Last modified: 2026-10-25 15:10 UTC
Weaknesses: CWE-400

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 10:39 UTC.