CVE-2026-8609: Pre-authentication denial of service via the OAuth login route
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8609?
CVE-2026-8609 has a medium severity rating of 5.3.
How can I fix CVE-2026-8609?
To fix CVE-2026-8609, update your Grafana instance to the latest version that includes a patch for this vulnerability.
What type of attack is possible with CVE-2026-8609?
CVE-2026-8609 allows for pre-authentication denial of service attacks via the OAuth login route.
What causes the denial of service in CVE-2026-8609?
The denial of service in CVE-2026-8609 is caused by an unauthenticated attacker repeatedly calling the OAuth login route with unique values, leading to unbounded memory growth.
Is CVE-2026-8609 exploitable without authentication?
Yes, CVE-2026-8609 is exploitable without authentication, allowing attackers to affect the Grafana instance.