Dashboard / CVE-2026-8609

CVE-2026-8609

HIGH
MEDIUM Priority: 0.03 BB Relevance: 75/100
Published: 2026-07-10 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: None
A: High

Description

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
grafana grafana 11.6.0 – 11.6.15

References & Advisories (1)

Bug Bounty Relevance

75 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

0.40%
Raw Score 0.003970
Percentile 33.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00397
2026-10-28
0.00397

Intelligence Sources

nvd ref →

External Links