All vulnerabilities
CVE-2026-88858

Grafana OSS: Server-side expression parser denial of service

Grafana Grafana OSSApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

Text from CVE List

Affected versions 14

  • Grafana OSSaffected: 7.4.0 through 11.6.16CVE List
  • Grafana OSSaffected: 12.0.0 through 12.2.10CVE List
  • Grafana OSSaffected: 12.3.0 through 12.3.11CVE List
  • Grafana OSSaffected: 12.4.0 through 12.4.13CVE List
  • Grafana OSSaffected: 13.0.0 through 13.0.11CVE List
  • Grafana OSSaffected: 13.1.0 through 13.1.8CVE List
  • Grafana OSSaffected: 13.2.0 through 13.2.4CVE List
  • Grafana Enterpriseaffected: 7.4.0 through 11.6.16CVE List
  • Grafana Enterpriseaffected: 12.0.0 through 12.2.10CVE List
  • Grafana Enterpriseaffected: 12.3.0 through 12.3.11CVE List
  • Grafana Enterpriseaffected: 12.4.0 through 12.4.13CVE List
  • Grafana Enterpriseaffected: 13.0.0 through 13.0.11CVE List
  • Grafana Enterpriseaffected: 13.1.0 through 13.1.8CVE List
  • Grafana Enterpriseaffected: 13.2.0 through 13.2.4CVE List

References 1