Is CVE-2026-8609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8609 being exploited in the wild.

How severe is CVE-2026-8609?

Medium severity, with a CVSS score of 5.3, published 10 July 2026.

Which products and versions are affected?

Grafana Labs Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1.

Is there a fix for CVE-2026-8609?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8609 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-8609?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8609: Grafana denial of service in OAuth login route

CVE-2026-8609 · Severity: medium · CVSS 5.3 · Published 2026-07-10

Grafana is a popular platform used for monitoring and visualizing data from various sources. A vulnerability in its login system allows an unauthorized person to crash the service by sending a large number of specific requests. This results in a denial of service, preventing legitimate users from accessing their monitoring dashboards and potentially disrupting operational visibility.

Quick answers

Is CVE-2026-8609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8609 being exploited in the wild.
How severe is CVE-2026-8609?: Medium severity, with a CVSS score of 5.3, published 10 July 2026.
Which products and versions are affected?: Grafana Labs Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1.
Is there a fix for CVE-2026-8609?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8609 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-8609?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in Grafana's OAuth login route due to uncontrolled resource consumption (CWE-400). An unauthenticated remote attacker can send repeated requests with unique values to the OAuth endpoint, triggering unbounded memory growth. This memory leak eventually leads to resource exhaustion and a crash of the Grafana process. The vulnerability is reachable over the network without any prior authentication or user interaction. Patches are available in versions 11.6.15, 12.2.9, 12.3.7, 12.4.4, and 13.0.2 or higher.

Affected products

Grafana Labs Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1

Timeline

2026-06-09: advisory: Initial advisory published by Grafana Labs
2026-07-10: disclosed: CVE published to NVD

References

https://grafana.com/security/security-advisories/cve-2026-8609

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.