CVE-2026-88858Medium· 6.5▾ SunlitA user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
oss >= 7.4.0 <= 11.6.16oss >= 12.0.0 <= 12.2.10oss >= 12.3.0 <= 12.3.11oss >= 12.4.0 <= 12.4.13oss >= 13.0.0 <= 13.0.11oss >= 13.1.0 <= 13.1.8oss >= 13.2.0 <= 13.2.4enterprise >= 7.4.0 <= 11.6.16enterprise >= 12.0.0 <= 12.2.10enterprise >= 12.3.0 <= 12.3.11enterprise >= 12.4.0 <= 12.4.13enterprise >= 13.0.0 <= 13.0.11enterprise >= 13.1.0 <= 13.1.8enterprise >= 13.2.0 <= 13.2.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
CVE-2026-79656Medium· 6.0OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
CVE-2026-88967High· 7.7Azure Monitor access token disclosure via SSRF
CVE-2026-13720Medium· 5.4An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an autho…
CVE-2026-76154High· 7.3A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…
CVE-2026-15815High· 8.8Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives