Vulnerability · Published Jul 10, 2026 · Assigned by GRAFANA
CVE-2026-8609Pre-authentication denial of service via the OAuth login route
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in Grafana OSS from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 65.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | grafana | 10.2.6-28.el10_2.4 | ALSA-2026:54178 |
| AlmaLinux:10 | grafana-selinux | 10.2.6-28.el10_2.4 | ALSA-2026:54178 |
| Alpine:v3.24 | grafana | 12.4.4-r0 | ALPINE-CVE-2026-8609 |
| Rocky Linux:10 | grafana | 0:10.2.6-28.el10_2.4 | RLSA-2026:54178 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana OSS | 11.6.0 – through 11.6.1412.2.0 – through 12.2.812.3.0 – through 12.3.612.4.0 – through 12.4.313.0.0 – through 13.0.1 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://grafana.com/security/security-advisories/cve-2026-8609 vendor-advisory