CVE-2026-88858: Server-side expression parser denial of service
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Grafana user with the Viewer role can trigger the denial of service by submitting a crafted server-side math expression. A user who can provision alert rules has additional impact because they can make the outage persist after server restarts.
What is required to exploit it?
The attacker needs network access to Grafana, a valid account with at least the Viewer role, and the ability to submit a crafted server-side math expression. No user interaction is required.
How can we tell whether an outage may persist after a restart?
Persistence across restarts is possible when a user with permission to provision alert rules has used the crafted expression in an alert rule. The provided information does not specify a detection method or affected configuration details.