---
id: CVE-2026-88858
title: Server-side expression parser denial of service
summary: >-
  A user with the Viewer role in Grafana can crash the server by submitting a
  crafted server-side math expression (uncontrolled recursion). A user with
  permission to provision alert rules can make the outage persist across
  restarts.
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-674
  - CWE-20
  - CWE-400
vendor: Grafana
product: Grafana OSS
affected:
  - oss >= 7.4.0 <= 11.6.16
  - oss >= 12.0.0 <= 12.2.10
  - oss >= 12.3.0 <= 12.3.11
  - oss >= 12.4.0 <= 12.4.13
  - oss >= 13.0.0 <= 13.0.11
  - oss >= 13.1.0 <= 13.1.8
  - oss >= 13.2.0 <= 13.2.4
  - enterprise >= 7.4.0 <= 11.6.16
  - enterprise >= 12.0.0 <= 12.2.10
  - enterprise >= 12.3.0 <= 12.3.11
  - enterprise >= 12.4.0 <= 12.4.13
  - enterprise >= 13.0.0 <= 13.0.11
  - enterprise >= 13.1.0 <= 13.1.8
  - enterprise >= 13.2.0 <= 13.2.4
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:50:17.291Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-88858'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-88858'
tags:
  - cve.org
ingestedAt: '2026-10-28T17:14:44.435Z'
---

## Overview

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

## Affected

- `oss >= 7.4.0 <= 11.6.16`
- `oss >= 12.0.0 <= 12.2.10`
- `oss >= 12.3.0 <= 12.3.11`
- `oss >= 12.4.0 <= 12.4.13`
- `oss >= 13.0.0 <= 13.0.11`
- `oss >= 13.1.0 <= 13.1.8`
- `oss >= 13.2.0 <= 13.2.4`
- `enterprise >= 7.4.0 <= 11.6.16`
- `enterprise >= 12.0.0 <= 12.2.10`
- `enterprise >= 12.3.0 <= 12.3.11`
- `enterprise >= 12.4.0 <= 12.4.13`
- `enterprise >= 13.0.0 <= 13.0.11`
- `enterprise >= 13.1.0 <= 13.1.8`
- `enterprise >= 13.2.0 <= 13.2.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.