6.5 Medium

CVE-2026-88858 Server-side expression parser denial of service

Description

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Grafana OSS 13.2	13.2.0 → 13.2.4	No fix stated
Grafana OSS 13.1	13.1.0 → 13.1.8	No fix stated
Grafana OSS 13.0	13.0.0 → 13.0.11	No fix stated
Grafana OSS 12.4	12.4.0 → 12.4.13	No fix stated
Grafana OSS 12.3	12.3.0 → 12.3.11	No fix stated
Grafana OSS 12.0	12.0.0 → 12.2.10	No fix stated
Grafana OSS 7.4	7.4.0 → 11.6.16	No fix stated
Grafana Enterprise 13.2	13.2.0 → 13.2.4	No fix stated
Grafana Enterprise 13.1	13.1.0 → 13.1.8	No fix stated

Show the 5 other branches

Product	Affected versions	Fixed in
Grafana Enterprise 13.0	13.0.0 → 13.0.11	No fix stated
Grafana Enterprise 12.4	12.4.0 → 12.4.13	No fix stated
Grafana Enterprise 12.3	12.3.0 → 12.3.11	No fix stated
Grafana Enterprise 12.0	12.0.0 → 12.2.10	No fix stated
Grafana Enterprise 7.4	7.4.0 → 11.6.16	No fix stated

References

grafana.com grafana.com

Timeline

Published October 28, 2026
Last modified November 5, 2026

The 45 CVEs of Grafana OSS →

CVE-2026-33379 Dashboard snapshot permission bypass 8.5 High CVE-2026-79656 OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors 6.0 Medium CVE-2026-103506 SSO settings authorization bypass 8.9 High CVE-2026-88967 Azure Monitor access token disclosure via SSRF 7.7 High

Track this CVE