BIT-grafana-2026-8609

vendorUSosv

Pre-authentication denial of service via the OAuth login route

view advisory published 2026-07-14Licence: per source

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-8609US	high7.5	0.40% (34th)	—	2026-07-10
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Gra…

references

External citations — patches, advisories, analysis.

https://grafana.com/security/security-advisories/cve-2026-8609ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-8609WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan