Executive brief
Grafana is a popular platform used for monitoring and visualizing data from various sources. A vulnerability in its login system allows an unauthorized person to crash the service by sending a large number of specific requests. This results in a denial of service, preventing legitimate users from accessing their monitoring dashboards and potentially disrupting operational visibility.
Technical details
A denial of service vulnerability exists in Grafana's OAuth login route due to uncontrolled resource consumption (CWE-400). An unauthenticated remote attacker can send repeated requests with unique values to the OAuth endpoint, triggering unbounded memory growth. This memory leak eventually leads to resource exhaustion and a crash of the Grafana process. The vulnerability is reachable over the network without any prior authentication or user interaction. Patches are available in versions 11.6.15, 12.2.9, 12.3.7, 12.4.4, and 13.0.2 or higher.
Affected products
- Grafana Labs Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1
Timeline
- 2026-06-09: advisory: Initial advisory published by Grafana Labs
- 2026-07-10: disclosed: CVE published to NVD