CVE-2026-88858

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88858", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-09-10T10:30:46.142Z", "datePublished": "2026-10-28T16:50:17.291Z", "dateUpdated": "2026-11-05T17:19:10.148Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.16", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.10", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.16", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.10", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mukul Goyal"}], "datePublic": "2026-10-27T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts."}], "metrics": [{"cvssV3_1": {"baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "description": "CWE-674", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "description": "CWE-400", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-28T16:50:17.291Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-88858"}], "source": {"discovery": "EXTERNAL_REPORT"}, "title": "Server-side expression parser denial of service"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T17:18:39.280865Z", "id": "CVE-2026-88858", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T17:19:10.148Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-88858", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T17:18:39.280865Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T17:19:01.331Z"}}], "cna": {"title": "Server-side expression parser denial of service", "source": {"discovery": "EXTERNAL_REPORT"}, "credits": [{"lang": "en", "type": "finder", "value": "Mukul Goyal"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "11.6.16"}, {"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.2.10"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.13"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.11"}, {"status": "affected", "version": "13.1.0", "versionType": "semver", "lessThanOrEqual": "13.1.8"}, {"status": "affected", "version": "13.2.0", "versionType": "semver", "lessThanOrEqual": "13.2.4"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "11.6.16"}, {"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.2.10"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.13"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.11"}, {"status": "affected", "version": "13.1.0", "versionType": "semver", "lessThanOrEqual": "13.1.8"}, {"status": "affected", "version": "13.2.0", "versionType": "semver", "lessThanOrEqual": "13.2.4"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-27T00:00:00.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-88858", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-28T16:50:17.291Z"}}}, "cveMetadata": {"cveId": "CVE-2026-88858", "state": "PUBLISHED", "dateUpdated": "2026-11-05T17:19:10.148Z", "dateReserved": "2026-09-10T10:30:46.142Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-10-28T16:50:17.291Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.16", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.10", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.16", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.10", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts."}], "id": "CVE-2026-88858", "lastModified": "2026-11-05T18:17:10.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88858", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T17:18:39.280865Z", "version": "2.0.3"}}]}, "published": "2026-10-28T17:18:45.967", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-88858"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-674"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Math expressions could crash Grafana", "id": "2554121", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554121"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.", "A flaw was found in Grafana. An authenticated user, including one with basic viewer privileges, can cause a Denial of Service (DoS) by submitting deeply nested mathematical expressions that crash the server. Additionally, an authorized user can incorporate such expressions into alert rules, causing the service crash to repeat continuously across restarts."], "mitigation": {"lang": "en:us", "value": "Disable server-side expressions in the Grafana configuration:\n1. Edit `/etc/grafana/grafana.ini` and set the following configuration under the `[expressions]` block:\n```ini\n[expressions]\nenabled = false\n```\n2. Restart the Grafana service:\n```bash\nsystemctl restart grafana-server\n```\nCaveats:\nDisabling expressions completely disables server-side math expressions as well as all expression-based alert rules.\nWarning: Restarting the `grafana-server` service will cause a temporary interruption of service for active sessions."}, "name": "CVE-2026-88858", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rhel10/grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rhel9/grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/grafana", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88858\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88858"], "statement": "Red Hat rates this vulnerability as Moderate severity because exploitation requires an authenticated account to submit malformed mathematical queries, resulting in denial of service rather than code execution or information disclosure. While low-privileged viewers can cause temporary service disruptions, triggering recurring crashes across application restarts requires elevated permissions to define persistent alert rules. In standard Red Hat deployments, Grafana instances are protected behind authentication boundaries, mitigating unauthenticated external threats.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,11.6.16]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.2.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.0,12.3.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.13]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,11.6.16]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.2.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.0,12.3.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.13]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana Enterprise", "source": "cna", "vendor": "Grafana"}, "product": "grafana_enterprise", "vendor": "grafana"}], "created": "2026-10-28T19:15:14.767040+00:00", "updated": "2026-10-30T02:45:07.614739+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana", "grafana$PRODUCT$grafana_enterprise"]}