Live › vulnerability › CVE-2026-88858
Go to dashboardA Grafana user with the Viewer role can submit a crafted server-side math expression that triggers uncontrolled recursion and crashes the server. A user allowed to provision alert rules can store the expression so the outage repeats after each restart.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Grafana instances where users can submit server-side expressions, which includes any instance with Viewer-role accounts reachable by untrusted users and any instance where alert rules can be provisioned. Instances with no untrusted users and no alerting exposure carry less risk.
No product ranges from the sources yet.
grafana-server -v or the About page in the UI.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
This page as .md · .json · in your agent: get_signal("CVE-2026-88858")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.