CVE-2026-8609

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8609", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-05-14T16:01:42.297Z", "datePublished": "2026-07-10T14:58:33.522Z", "dateUpdated": "2026-08-27T17:22:37.575Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:37.575Z"}, "datePublic": "2026-06-09T00:00:00.000Z", "title": "Pre-authentication denial of service via the OAuth login route", "descriptions": [{"lang": "en", "value": "An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service)."}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "defaultStatus": "unaffected", "versions": [{"version": "11.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"version": "12.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"version": "12.3.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"version": "12.4.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"version": "13.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.0.1"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-400", "cweId": "CWE-400", "type": "CWE"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-8609", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "credits": [{"lang": "en", "value": "cyberjoker (Researcher)", "type": "finder"}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T15:53:40.169487Z", "id": "CVE-2026-8609", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T15:53:51.365Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8609", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T15:53:40.169487Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T15:53:27.882Z"}}], "cna": {"title": "Pre-authentication denial of service via the OAuth login route", "source": {"discovery": "BUG_BOUNTY"}, "credits": [{"lang": "en", "type": "finder", "value": "cyberjoker (Researcher)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"status": "affected", "version": "12.2.0", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-06-09T00:00:00.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-8609", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-26T08:50:29.001Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8609", "state": "PUBLISHED", "dateUpdated": "2026-08-26T08:50:29.001Z", "dateReserved": "2026-05-14T16:01:42.297Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-07-10T14:58:33.522Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.14", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.8", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.6", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.3", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.1", "status": "affected", "version": "13.0.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "B154BC07-0914-4E25-9D84-FB64205493F7", "versionEndExcluding": "11.6.15", "versionStartIncluding": "11.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "052CFAA8-0386-43DF-869A-643997178E8D", "versionEndExcluding": "12.2.9", "versionStartIncluding": "12.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "C77AA4CC-A590-4948-A010-5A1154502E47", "versionEndExcluding": "12.3.7", "versionStartIncluding": "12.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "F820291A-C1C6-4DBC-8064-6133F16547C4", "versionEndExcluding": "12.4.4", "versionStartIncluding": "12.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "643002A3-545F-4605-AAAF-EF55C5B14392", "versionEndExcluding": "13.0.2", "versionStartIncluding": "13.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service)."}, {"lang": "es", "value": "Un atacante no autenticado puede llamar repetidamente a la ruta de inicio de sesi\u00f3n OAuth de Grafana con valores \u00fanicos, causando un crecimiento ilimitado de la memoria que puede agotar la memoria con el tiempo y bloquear la instancia de Grafana (denegaci\u00f3n de servicio)."}], "id": "CVE-2026-8609", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@grafana.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8609", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T15:53:40.169487Z", "version": "2.0.3"}}]}, "published": "2026-07-10T16:16:39.510", "references": [{"source": "security@grafana.com", "tags": ["Vendor Advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-8609"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security@grafana.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route", "id": "2499061", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499061"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).", "A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate users."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to the Grafana instance to trusted internal networks or localhost. If a reverse proxy or load balancer is deployed in front of Grafana, configure it to implement rate limiting on requests to the OAuth login endpoint to prevent an attacker from exhausting system resources. If OAuth is not required, consider disabling it in the Grafana configuration, though this may impact user authentication workflows."}, "name": "CVE-2026-8609", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Not affected", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Not affected", "package_name": "rhceph/rhceph-5-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Not affected", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Not affected", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Not affected", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-10T14:58:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-8609\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-8609\nhttps://grafana.com/security/security-advisories/cve-2026-8609"], "statement": "The flaw in Grafana is rated Moderate, as an unauthenticated attacker can trigger a denial of service by repeatedly accessing the OAuth login route, leading to unbounded memory growth and instance crashes.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.0,11.6.14]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.2.0,12.2.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.0,12.3.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.1]"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}], "created": "2026-07-11T11:00:06.124378+00:00", "updated": "2026-08-01T12:45:03.466600+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"]}