Grafana CVE-2026-88858

Exploitation requires an authenticated Grafana account with at least the Viewer role (per CVSS PR:L) and the ability to submit a server-side math expression (used in Grafana's alerting/expression feature); the crafted expression triggers uncontrolled recursion that crashes the server. The transient crash needs only Viewer access, but making the outage persist across restarts additionally requires the higher privilege of permission to provision alert rules. Limiting factors: the attacker must be authenticated (not anonymous), and persistence specifically depends on alert-rule-provisioning rights; impact is confined to availability (service crash), with no confidentiality or integrity effect. Affected branches include Grafana OSS and Enterprise from the 7.4.0 line through the 13.2.x line per EUVD; instances on patched releases above the listed per-branch upper bounds are not affected.

This is a medium-severity availability-only vulnerability (CVSS 6.5, A:H with C:N/I:N) whose real-world risk is moderate and self-consistent across the available signals. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity crash that nonetheless requires authentication - specifically only the Viewer role, which is the lowest-privileged authenticated role in Grafana and is often granted broadly (including to SSO/org users), so the PR:L barrier is low in practice. No EPSS score, CISA KEV listing, or PoC/exploit reference is present in the input, so there is no evidence of active exploitation or published exploit code. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with a non-emergency but patch-worthy DoS. The signals do not conflict: a low-complexity, low-privilege, network DoS on a very widely deployed monitoring platform is a credible operational-availability concern but not a confidentiality/integrity breach, and the lack of exploitation telemetry (no KEV, no EPSS, no PoC) suggests it is a priority for routine patching rather than an incident-driven emergency. Note that EPSS is absent, so exploitation probability cannot be quantified from this data.

An attacker who holds (or obtains) any Viewer-level account on a reachable Grafana instance submits a crafted server-side math expression that triggers uncontrolled recursion, crashing the Grafana server and causing a denial of service for all users. If the attacker additionally has permission to provision alert rules, the malicious expression can be stored so the crash recurs on every restart, turning a transient outage into a persistent one. No public exploit code or PoC reference is provided in the input.