Description
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Published: 2026-07-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated attacker can repeatedly invoke triggering unbounded memory growth that eventually exhausts system memory and crashes the instance. The weakness is a classic uncontrolled resource consumption scenario classified as CWE‑400 and CWE‑770, compromising availability.

Affected Systems

Grafana OSS is the affected product. The advisory does not state impacted releases, so all current Grafana OSS versions are potentially vulnerable until an official fix is issued or a workaround is applied.

Risk and Exploitability

The attack is performed over the network via the public OAuth login endpoint, which is reachable from the Internet. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker needs no credentials to send repeated requests to drain memory and force a denial of service.

Generated by OpenCVE AI on July 28, 2026 at 08:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict access to the OAuth login route by implementing a firewall rule or reverse‑proxy restriction that limits requests to trusted IP addresses.
  • Enable application‑level rate limiting or throttling for the OAuth endpoint to cap the number of requests within a given time frame, preventing memory exhaustion.
  • Monitor memory usage and set alerts for abnormal spikes; in the event of memory pressure, restart or reboot the Grafana instance to restore availability.
  • Check the Grafana security advisory or website for an official patch or upgrade recommendation as soon as one is released.

Generated by OpenCVE AI on July 28, 2026 at 08:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 13 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Grafana
Grafana grafana
Vendors & Products Grafana
Grafana grafana

Fri, 10 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Title Pre-authentication denial of service via the OAuth login route
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Grafana Grafana
cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-07-29T14:00:05.742Z

Reserved: 2026-05-14T16:01:42.297Z

Link: CVE-2026-8609

cve-icon Vulnrichment

Updated: 2026-07-10T15:53:27.882Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-10T14:58:33Z

Links: CVE-2026-8609 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-28T08:30:18Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling