CVE-2026-8609: Grafana OAuth Login DoS Vulnerability

CVE-2026-8609 Overview

CVE-2026-8609 is a denial-of-service vulnerability in Grafana caused by unbounded memory growth in the OAuth login route. An unauthenticated attacker can repeatedly call the OAuth login endpoint with unique values, forcing the server to allocate memory without releasing it. Sustained requests exhaust available memory and crash the Grafana instance. The flaw is classified under [CWE-400] Uncontrolled Resource Consumption and affects Grafana across multiple release lines. Grafana Labs published a security advisory tracking the issue.

Critical Impact
Unauthenticated remote attackers can crash Grafana instances by exhausting memory through repeated OAuth login requests, disrupting observability and monitoring workflows.

Affected Products

Grafana OSS across affected release lines listed in the vendor advisory
Grafana Enterprise deployments running vulnerable versions
Self-hosted Grafana instances exposing the OAuth login route to untrusted networks

Discovery Timeline

2026-07-10 - CVE-2026-8609 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-8609

Vulnerability Analysis

The vulnerability resides in Grafana's OAuth login route handling. When an unauthenticated client initiates an OAuth login, Grafana allocates server-side state to track the request. The route accepts unique input values without rate limiting or state cap enforcement. Each request expands an in-memory data structure that is not evicted or bounded.

An attacker can script repeated calls to the OAuth login endpoint, supplying different values on each request. Memory usage grows linearly with request volume until the Go runtime cannot allocate additional heap. The Grafana process terminates or becomes unresponsive, denying service to legitimate users. Because the attack does not require credentials or user interaction, any exposed instance is reachable over the network.

Root Cause

The root cause is missing resource limits on state stored during the OAuth authorization flow. Grafana does not cap the number of pending login states per source, nor does it expire entries aggressively enough to survive high-rate abuse. This maps directly to [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a high volume of HTTP requests to the Grafana OAuth login endpoint, varying request parameters to bypass any deduplication. The impact is limited to availability - confidentiality and integrity are not affected. Refer to the Grafana Security Advisory for endpoint-specific details.

Detection Methods for CVE-2026-8609

Indicators of Compromise

Sudden spike in HTTP requests to the Grafana OAuth login route from a single source or small set of sources
Rapidly increasing resident memory (RSS) of the grafana-server process without corresponding user activity
Grafana process crashes with out-of-memory (OOM) kills logged in dmesg or container runtime logs
Repeated login attempts with distinct query parameters or state values from unauthenticated clients

Detection Strategies

Baseline normal request rates to /login/* and OAuth callback endpoints, then alert on deviations
Correlate web access logs with process memory metrics to identify request-driven memory growth
Monitor for high cardinality of unique parameter values against the OAuth login route within short time windows
Ingest Grafana access logs and host telemetry into a centralized data lake to run cross-source queries

Monitoring Recommendations

Track grafana-server memory utilization with Prometheus or a comparable metrics pipeline and alert above defined thresholds
Log all requests to OAuth endpoints at the reverse proxy layer for forensic replay
Enable OOM-killer notifications on the underlying host or Kubernetes node hosting Grafana

How to Mitigate CVE-2026-8609

Immediate Actions Required

Upgrade Grafana to the fixed release identified in the Grafana Security Advisory
Restrict network exposure of the Grafana OAuth login route to trusted networks or VPN users until patched
Deploy a reverse proxy or WAF rule to rate-limit requests to /login/* endpoints per source IP
Configure container or systemd memory limits so an exhausted instance restarts cleanly instead of destabilizing the host

Patch Information

Grafana Labs has published a fix in the versions referenced in the Grafana Security Advisory. Administrators should consult the advisory for exact fixed version numbers matching their deployed release line and apply the upgrade following standard Grafana update procedures.

Workarounds

Place Grafana behind an authenticating reverse proxy that enforces per-IP request quotas on OAuth endpoints
Disable OAuth-based authentication temporarily if it is not required, using local or LDAP authentication instead
Deploy connection and request rate limits at the load balancer to cap unauthenticated traffic to the login route

bash

# Example NGINX rate limit for Grafana OAuth login route
limit_req_zone $binary_remote_addr zone=grafana_login:10m rate=5r/m;

server {
    location /login/ {
        limit_req zone=grafana_login burst=10 nodelay;
        proxy_pass http://grafana_upstream;
    }
}