CVEvulnerability

CVE-2026-88858

6.5 MEDIUM Published 2026-10-28 Modified 2026-10-29 Official page ↗
Status
Awaiting Analysis
Published
2026-10-28
Last modified
2026-10-29
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-400, CWE-674

Description

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

Related

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-674 Uncontrolled Recursion weakness

References