What is CVE-2026-8609?

CVE-2026-8609 is a security advisory published by Grafana Labs Security. Pre-authentication denial of service in the OAuth login route

Why does CVE-2026-8609 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by CVE-2026-8609?

CVE-2026-8609 affects 1 product, including: Grafana.

CVE-2026-8609Disclosed before NVD

Pre-authentication denial of service in the OAuth login route

Vendor

Grafana Labs Security

Published

June 9, 2026

Last Modified

—

📋 Description

An unauthenticated attacker can repeatedly call Grafana’s OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service). Upgrade to a fixed version listed below.

🎯 Affected products1

Grafana

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-8609/