CVE-2026-88858
Received
Received - Intake
Grafana Server Crash via Recursive Math Expression
Vulnerability report for CVE-2026-88858, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-28
Last updated on: 2026-10-28
Assigner: Grafana Labs
Description
Description
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Grafana | Grafana OSS | 7.4.0 |
| Grafana | Grafana OSS | 12.0.0 |
| Grafana | Grafana OSS | 12.3.0 |
| Grafana | Grafana OSS | 12.4.0 |
| Grafana | Grafana OSS | 13.0.0 |
| Grafana | Grafana OSS | 13.1.0 |
| Grafana | Grafana OSS | 13.2.0 |
| Grafana | Grafana Enterprise | 7.4.0 |
| Grafana | Grafana Enterprise | 12.0.0 |
| Grafana | Grafana Enterprise | 12.3.0 |
| Grafana | Grafana Enterprise | 12.4.0 |
| Grafana | Grafana Enterprise | 13.0.0 |
| Grafana | Grafana Enterprise | 13.1.0 |
| Grafana | Grafana Enterprise | 13.2.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
