Bug 2563431

Summary:	CVE-2026-88858 grafana: Math expressions could crash Grafana [fedora-43]
Product:	[Fedora] Fedora	Reporter:	Srikanth Balasubramanian <sbalasub>
Component:	grafana	Assignee:	sfeifer
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	43	CC:	go-sig, jkurik, nathans, sfeifer, wcohen
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["bea5d699-e9c6-4fe5-8252-e0093266a87c"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2554121

Description Srikanth Balasubramanian 2026-10-29 15:28:10 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Short description of the vulnerability: 

A signed-in user, including a user with the Viewer role, could crash Grafana by sending a deeply nested math expression. A user allowed to create alert rules could make the crash repeat on every restart. The fixed versions limit how deeply expressions can be nested. 

Known mitigations: 

There is no simple workaround. Disabling server-side expressions ([expressions] enabled = false) prevents the issue but also disables expression-based alerting. 

Affected products and versions: 

Grafana and Grafana Enterprise 12.4.0 to 12.4.13, 13.0.0 to 13.0.11, 13.1.0 to 13.1.8, and 13.2.0 to 13.2.4. Versions 7.4.0 to 12.3.11 are also affected; they are end of life and will not receive a fix. 

Affected platforms: 

Self-managed (on-premise)