This vulnerability (CVE-2026-8609) in Grafana OSS involves a denial of service caused by uncontrolled memory growth when an unauthenticated attacker repeatedly calls the OAuth login endpoint with unique inputs. The flaw is categorized under CWE-400 (Uncontrolled Resource Consumption). The attack does not require privileges or user interaction and impacts availability by crashing the service due to memory exhaustion. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability loss. Affected versions explicitly include 11.6.0, 12.2.0, 12.3.0, 12.4.0, and 13.0.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An unauthenticated attacker can cause a denial of service by exhausting memory resources on the Grafana OSS server through repeated calls to the OAuth login route with unique values. This results in the Grafana instance crashing and becoming unavailable. There is no confidentiality or integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as rate limiting or firewall rules to restrict repeated OAuth login requests from unauthenticated sources.