Bug 2554121 (CVE-2026-88858) - CVE-2026-88858 grafana: Math expressions could crash Grafana
Summary: CVE-2026-88858 grafana: Math expressions could crash Grafana
Keywords:
Status: NEW
Alias: CVE-2026-88858
Deadline: 2026-10-28
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2563423 2563431
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-16 13:56 UTC by OSIDB Bzimport
Modified: 2026-10-29 15:28 UTC (History)
19 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-16 13:56:00 UTC 
Short description of the vulnerability: 

A signed-in user, including a user with the Viewer role, could crash Grafana by sending a deeply nested math expression. A user allowed to create alert rules could make the crash repeat on every restart. The fixed versions limit how deeply expressions can be nested. 

Known mitigations: 

There is no simple workaround. Disabling server-side expressions ([expressions] enabled = false) prevents the issue but also disables expression-based alerting. 

Affected products and versions: 

Grafana and Grafana Enterprise 12.4.0 to 12.4.13, 13.0.0 to 13.0.11, 13.1.0 to 13.1.8, and 13.2.0 to 13.2.4. Versions 7.4.0 to 12.3.11 are also affected; they are end of life and will not receive a fix. 

Affected platforms: 

Self-managed (on-premise)
Note You need to log in before you can comment on or make changes to this bug.