CVE-2026-8609

Pre-authentication denial of service via the OAuth login route

View on CVE.org
Published Jul 10, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

Analysis

AI-generated

Technical impact

An unauthenticated attacker can repeatedly invoke the OAuth login route with unique values, causing unbounded memory growth that eventually exhausts system memory and crashes the instance. This behaviour is classified as CWE‑400 and CWE‑770, which compromise availability. The description is taken directly from the advisory information.

Affected Systems

Based on the advisory, Grafana OSS is the affected product. The advisory does not list specific releases, so it is inferred that all current Grafana OSS versions may be vulnerable until an official fix is issued or a workaround is applied.

Risk and Exploitability

Based on the description, it is inferred that the attacker targets the publicly exposed OAuth login endpoint over the network, sending repeated requests to drain memory and force a denial of service. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker requires no credentials to perform this exploit.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict access to the OAuth login route by implementing a firewall rule or reverse‑proxy restriction that limits requests to trusted IP addresses.
  • Enable application‑level rate limiting or throttling for the OAuth endpoint to cap the number of requests within a given time frame, preventing memory exhaustion.
  • Monitor memory usage and set alerts for abnormal spikes; in the event of memory pressure, restart or reboot the Grafana instance to restore availability.
  • Check the Grafana security advisory or website for an official patch or upgrade recommendation as soon as one is released.

Generated by OpenCVE AI on August 1, 2026 at 12:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Grafana
Grafana grafana
Vendors & Products Grafana
Grafana grafana
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Title Pre-authentication denial of service via the OAuth login route
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}
Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling

Sources

Status
PUBLISHED
Assigner
GRAFANA
Published
Updated
Aug 27, 2026, 5:22 PM
Reserved
May 14, 2026, 4:01 PM

View source JSON

Updated
Jul 10, 2026, 3:53 PM

JSON

Status
Analyzed
Published
Jul 10, 2026, 4:16 PM
Modified
Oct 25, 2026, 3:10 PM

View source JSON

Severity
Moderate
Public date
Jul 10, 2026, 2:58 PM

View source Bugzilla JSON

Updated
Aug 1, 2026, 12:45 PM

JSON