CVE-2026-8609

🔶 medium

Summary

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

CVSS Score

5.3

Medium

EPSS Score

0.4

Exploit Probability

Published Date

2026-07-10

First Seen: 2026-07-11

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 19.0% of all 365,890 vulnerabilities in our database.

#296,520

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jul 10, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

cyberjoker (Researcher)

SSVC data provided by CISA

Last Modified 2026-07-13

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE IDs (Weakness Types)

CWE-400

📦 Affected Products 5

Vendor	Product	Status	Affected Versions
grafana	grafana	Affected	> 11.6.0 < 11.6.15
grafana	grafana	Affected	> 12.2.0 < 12.2.9
grafana	grafana	Affected	> 12.3.0 < 12.3.7
grafana	grafana	Affected	> 12.4.0 < 12.4.4
grafana	grafana	Affected	> 13.0.0 < 13.0.2

🔗 References 1

https://grafana.com/security/security-advisories/cve...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-14199	⚠️ high	7.1	0.3	Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z...	2026-09-02
CVE-2026-33382	⚠️ high	7.5	0.4	Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing...	2026-07-10
CVE-2026-8595	🔶 medium	6.8	0.2	A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that ex...	2026-07-10
CVE-2026-28378	ℹ️ low	3.1	0.1	The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organizatio...	2026-07-07
CVE-2026-10601	🔶 medium	5.4	0.3	A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach uni...	2026-06-22
CVE-2026-9029	⚠️ high	7.3	0.3	A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer ...	2026-06-22

These CVEs affect the same products