CVE-2026-88858

A flaw was found in Grafana. An authenticated user, including one with basic viewer privileges, can cause a Denial of Service (DoS) by submitting deeply nested mathematical expressions that crash the server. Additionally, an authorized user can incorporate such expressions into alert rules, causing the service crash to repeat continuously across restarts.

This issue is rated Moderate per upstream Grafana Labs (CVSS 6.5). An authenticated user with Viewer privileges can crash the Grafana server by submitting a crafted server-side math expression that triggers uncontrolled recursion. A user who can provision alert rules can make the outage persist across restarts. Confidentiality and integrity are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable server-side expressions in the Grafana configuration:

1. Edit /etc/grafana/grafana.ini and set the following configuration under the [expressions] block:

[expressions]
enabled = false

2. Restart the Grafana service:

systemctl restart grafana-server

Caveats: Disabling expressions completely disables server-side math expressions as well as all expression-based alert rules.

Warning: Restarting the grafana-server service will cause a temporary interruption of service for active sessions.