UBUNTU-CVE-2026-88858: Medium severity ubuntu/grafana vulnerability
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Grafana user with the Viewer role can trigger the server crash by submitting a crafted server-side math expression. No user interaction is required.
What additional access is needed to make the outage survive a restart?
The attacker needs permission to provision alert rules. That permission allows the crafted expression to persist and cause the outage again after Grafana restarts.
What is the practical impact?
Successful exploitation causes a denial of service by crashing the Grafana server through uncontrolled recursion. The provided severity vector indicates no confidentiality or integrity impact.