CVE-2026-8609CWE-400

Pre-authentication denial of service via the OAuth login route

Medium · published July 10, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.8th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-07-10T14:58Z
EPSS history
Timeline
  • 10 JUL 14:58Z
    Pre-authentication denial of service via the OAuth login route
    cvelistv5