CVE-2026-88858medium6.5
Server-side expression parser denial of service
Impact
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
Source excerpt · GRAFANAAffected packages
This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Grafana · Grafana OSS
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 7.4.0 through 11.6.16 (inclusive) | affected |
| 12.0.0 through 12.2.10 (inclusive) | affected |
| 12.3.0 through 12.3.11 (inclusive) | affected |
| 12.4.0 through 12.4.13 (inclusive) | affected |
| 13.0.0 through 13.0.11 (inclusive) | affected |
| 13.1.0 through 13.1.8 (inclusive) | affected |
| 13.2.0 through 13.2.4 (inclusive) | affected |
Grafana · Grafana Enterprise
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 7.4.0 through 11.6.16 (inclusive) | affected |
| 12.0.0 through 12.2.10 (inclusive) | affected |
| 12.3.0 through 12.3.11 (inclusive) | affected |
| 12.4.0 through 12.4.13 (inclusive) | affected |
| 13.0.0 through 13.0.11 (inclusive) | affected |
| 13.1.0 through 13.1.8 (inclusive) | affected |
| 13.2.0 through 13.2.4 (inclusive) | affected |
Original source description
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.