Grafana: Viewer-level user crashes the server with a recursive math expression

Impact

Any authenticated user with only the Viewer role can submit a crafted server-side math expression that recurses without bound and takes the Grafana process down. A user who can also provision alert rules can persist the crash across restarts, turning a one-off outage into a repeating one. For a GPU fleet Grafana is usually the single pane over DCGM metrics, node health and job telemetry, so losing it blinds operators to thermal, ECC and fabric alarms while the fleet keeps running - and if alerting flows through the same instance, GPU failure alerts stop arriving. Impact is availability only; no data is exposed.

Who can reach it

Authenticated, lowest-privilege Grafana account (Viewer) over HTTP to the Grafana API. Persistence across restarts additionally needs alert-rule provisioning permission. If the Grafana instance is reachable by tenants or by anyone with an SSO account, that is the exposure.

What to do

Upgrade Grafana to the fixed release named in the vendor advisory and restart the service; the record carries no version numbers, so read grafana.com/security/security-advisories/cve-2026-88858 for the exact builds. Restarting a single Grafana process is cheap and touches no GPU nodes. If a persistent crash is already in place, remove the offending provisioned alert rule before restarting, or the server will crash again on start.

References

Related entries

• Jenkins Bitbucket Push and Pull Request Plugin: webhook payload can redirect credentialed requestsCVE-2026-92139 · Jenkins Bitbucket Push and Pull Request Plugin (webhook-supplied URLs)Medium
• Airflow HashiCorp provider: path-shaped Variable key crosses team scope in the Vault secrets backendCVE-2026-97636 · Apache Airflow HashiCorp provider (Vault secrets backend, team-scoped variable lookup)Medium
• Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients): Ceph's Python code constructs imaplib.IMAP4_SSL andNCVD-2024-010-ceph-python-bindings-imap4-ssl-s · Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients)Medium
• rclone (serve s3): Path traversal in rclone's S3 gateway lets a caller read and overwrite files above the served root.NCVD-2026-042-rclone-serve-s3 · rclone (serve s3)Medium
• KubeEdge CloudHub (viaduct packer, pkg/viaduct/pkg/packer): ONE COMPROMISED EDGE NODE TAKES DOWN CLOUD-EDGENCVD-2026-053-kubeedge-cloudhub-viaduct-packer · KubeEdge CloudHub (viaduct packer, pkg/viaduct/pkg/packer)Medium
• GitLab CE/EE: pipeline creation race lets a developer act in the context of another user's merge request commitCVE-2024-11222 · GitLab CE/EE (pipeline creation race condition)Medium