CVE-2026-8609: grafana from 11.6.0 (inclusive), before 11.6.15 (exclusive), from 12.2.0 (inclusive), before 12.2.9 (exclusive), from…

Affected technology

grafana · from 11.6.0 (inclusive), before 11.6.15 (exclusive)
grafana

grafana · from 12.2.0 (inclusive), before 12.2.9 (exclusive)
grafana

grafana · from 12.3.0 (inclusive), before 12.3.7 (exclusive)
grafana

grafana · from 12.4.0 (inclusive), before 12.4.4 (exclusive)
grafana

grafana · from 13.0.0 (inclusive), before 13.0.2 (exclusive)
grafana

Grafana OSS · 11.6.0 through 11.6.14, 12.2.0 through 12.2.8, 12.3.0 through 12.3.6, 12.4.0 through 12.4.3, 13.0.0 through 13.0.1
Grafana

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service). Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.