Server-side expression parser denial of service

Medium
Advisory ID:
CVE-2026-88858
Published:
2026-10-27
Product:
Grafana
CVSS Score:
6.5
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Fixed Versions:
<7.4.0
>=12.4.14 <13.0.0
>=13.0.12 <13.1.0
>=13.1.9 <13.2.0
>=13.2.5

Summary

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

Thanks to Mukul Goyal for reporting this vulnerability to us.