Grafana 11.1.2 → 11.6.12
64 releases · 3 breaking changes · 51 security fixes · 5 advisories fixed
51security3breaking0deprecated252feature213fix
Vulnerabilities fixed by this upgrade
- 3.3 CVE-2026-21727 A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
- 9.1 CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
- 5.3 CVE-2026-21722 Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi…
- 7.5 CVE-2026-21720 Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops…
- 8.1 CVE-2026-21721 The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa…
Breaking changes
- breaking Data source: Change Permissions for query to only have query and not read OR query (Enterprise) in 11.6.0
- breaking Loki: Default to /labels API with query param instead of /series API in 11.5.0
- breaking Folders: Allow folder editors and admins to create subfolders without any additional permissions in 11.2.0
Security changes
- security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 11.6.11
- security Fixes CVE-2026-21722: Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi… in 11.6.10
- security Fixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa… in 11.6.9
- security Fixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… in 11.6.9
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.6.4
- security Security: Fixes CVE-2025-3415 in 11.6.3
- security Security: Fix CVE-2025-3454 in 11.6.2
- security Security: Fix CVE-2025-2703 in 11.6.2
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.6.1
- security Chore: Update JWT library (CVE-2025-30204) in 11.6.1
- security Dependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923 in 11.6.1
- security Security: Fix CVE-2025-3454 in 11.6.1
- security Security: Fix CVE-2025-2703 in 11.6.1
- security Security: Fix CVE-2025-3260 in 11.6.1
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 11.6.0
- security Chore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786 in 11.6.0
- security App Platform: Pin bleve to fix CVE-2022-31022 in 11.6.0
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.5.7
- security Security: Fixes CVE-2025-3415 in 11.5.6
- security Security: Fix CVE-2025-3454 in 11.5.5
- security Security: Fix CVE-2025-2703 in 11.5.5
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.5.4
- security Dependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923 in 11.5.4
- security Security: Fix CVE-2025-3454 in 11.5.4
- security Security: Fix CVE-2025-2703 in 11.5.4
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.4.7
- security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 11.4.6
- security Security: Fixes CVE-2025-3415 in 11.4.6
- security Security: Fix CVE-2025-3454 in 11.4.5
- security Security: Fix CVE-2025-2703 in 11.4.5
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.4.4
- security Security: Fix CVE-2025-3454 in 11.4.4
- security Security: Fix CVE-2025-2703 in 11.4.4
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.3.9
- security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 11.3.8
- security Security: Fixes CVE-2025-3415 in 11.3.8
- security Security: Fix CVE-2025-3454 in 11.3.7
- security Security: Fix CVE-2025-2703 in 11.3.7
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.3.6
- security Security: Fix CVE-2025-3454 in 11.3.6
- security Security: Fix CVE-2025-2703 in 11.3.6
- security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.3.0
- security Security: Fix CVE-2025-3454 in 11.2.10
- security Security: Fix CVE-2025-2703 in 11.2.10
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.2.9
- security Security: Fix CVE-2025-3454 in 11.2.9
- security Security: Fix CVE-2025-2703 in 11.2.9
- security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.2.3
- security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.1.8
- security Alerting: Fixed CVE-2024-8118. in 11.1.7
- security Swagger: Fixed CVE-2024-6837. in 11.1.4
Every release in between
securityFixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
featureAlerting: Add limits for the size of expanded notification templates
featureCorrelations: Remove support for org_id=0
featureGo: Update to 1.25.7
featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled
securityFixes CVE-2026-21722: Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi…
featureAPI: Add missing scope check on dashboards
featureAvatar: Require sign-in, remove queue, respect timeout
featureGo: Update to 1.25.6
fixAlerting: Fix a race condition panic in ResetStateByRuleUID
securityFixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa…
securityFixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops…
featureAlerting: Update alerting dependency
featureDependencies: Bump Go to v1.25.5
featurePDFTables: Dynamically shrink font to try and fit whole table in pdf page width (Enterprise)
featurePlugins: Add PluginContext to plugins when scenes is disabled
fixAlerting: Fix contacts point issues
fixAlerting: Fix unmarshalling of GettableStatus to include time intervals
fixAnalyticsSummaries: Fix dashboard rollup not resetting "last X days" metrics to zero (Enterprise)
fixAnalyticsSummaries: Fix dashboard rollup totals resetting incorrectly (Enterprise)
fixSeeder: Add check in filterRemovedPermissions for already existing new permissions before seeding (Enterprise)
featureAnalytics: Apply proper batching to Loki exports and add configurable settings (Enterprise)
featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0
featureGo: Update to 1.25.3
fixAuth: Fix render user OAuth passthrough
fixLDAP Authentication: Fix URL to propagate username context as parameter
fixPlugins: Dependencies do not inherit parent URL for preinstall
fixURLParams: Stringify true values as key=true always (fixes issues with variables with true value)
featureAlerting: Update alerting module
featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)
featureAuditing: Document new options for recording datasource query request/response body
fixAlerting: Fix copying of recording rule fields
fixFix: Fix redirection after login when Grafana is served from subpath
featureAlerting: Bump alerting package to include change to NewTLSClient
featureGo: Update to 1.24.6
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
featureStateTimeline: Add endTime to tooltip
featureUnified storage: Respect GF_DATABASE_URL override
fixAlerting: Fix group interval override when adding new rules
fixAzure: Fix legend formatting
fixAzure: Fix resource name determination in template variable queries
fixGraphite: Fix annotation queries
fixGraphite: Fix date mutation
fixGraphite: Fix nested variable interpolation for repeated rows
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.4-git to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.6 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0
fixDashboard: Fixes issue with row repeats and first row
fixGraphite: Ensure template variables are interpolated correctly
fixGraphite: Fix Graphite series interpolation
fixPrometheus: Fix semver import path
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
securityChore: Update JWT library (CVE-2025-30204)
featureDashboardScenePage: Correct slug in self referencing data links
securityDependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
featureGrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
featurePrometheus: Add support for cloud partners Prometheus data sources
fixAlertmanager: Add Role-Based Access Control via reqAction Field
fixGrafanaUI: Remove blurred background from overlay backdrops to improve performance
fixInfluxDB: Fix nested variable interpolation
fixLDAP test: Fix page crash
fixOrg redirection: Fix linking between orgs
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securitySecurity: Fix CVE-2025-3260
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
featureAPI keys: Migrate API keys to service accounts at startup
featureAccessControl: Allow plugin roles to include plugins:write
featureAlerting: Add DAG errors to alert rule creation and view
featureAlerting: Add Jira integration to cloud AMs
featureAlerting: Add alert rule version history - part1
featureAlerting: Add migration to clean up rule versions table
featureAlerting: Add multiple threshold operators
featureAlerting: Add tracking for the mode used in query and notifications step when c…
featureAlerting: Adding color option for slack receiver
featureAlerting: Allow selection of recording rule write target on per-rule basis.
featureAlerting: Allow specifying uid for new rules added to groups
featureAlerting: Improve template testing by trying non-root scopes
featureAlerting: Include time range in template dashboard and panel urls
featureAlerting: Keep the latest version of deleted rule in version table
featureAlerting: Promote alertingSaveStateCompressed flag to public preview
featureAlerting: Remove ID and OrgID from hash calculation
featureAlerting: Remove feature toggle alertingNoNormalState
featureAlerting: Remove rule group edit from single rule editor
featureAlerting: Return 404 when /api/ruler/grafana/api/v1/rules/{Namespace}/{Groupname} does not exist
featureAlerting: Rule history restore feature
featureAlerting: Support Jira Integration
featureAlerting: Track if new gm rules are created with queries and expressions transformable to simple mode
featureAlerting: Update IRM copies in Configuration Tracker
featureAlerting: Update design of rule details tab and add updated by
featureAlerting: Update irm links for incident and oncall in case new irm plugin is present
featureAlerting: Use exponential backoff in the remote Alertmanager readiness check
featureAlerting: Use uid instead of id in AnnotationsStateHistory
featureAuth: Add IP address login attempt validation
featureAuth: Add support for the TlsSkipVerify parameter to JWT Auth
featureAuth: Make ssoSettingsSAML GA and enabled by default
featureAzure Monitor: Filter namespaces by resource group
featureAzure: Resource picker improvements
featureAzure: Variable editor and resource picker improvements
featureBadge: Add darkgrey color
featureCanvas: One click links and actions
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
securityChore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786
securityApp Platform: Pin bleve to fix CVE-2022-31022
+105 more items in the release notesfeatureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0
featureGo: Update to 1.25.3
fixAuth: Fix render user OAuth passthrough
fixLDAP Authentication: Fix URL to propagate username context as parameter
fixPlugins: Dependencies do not inherit parent URL for preinstall
featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)
featureAuditing: Document new options for recording datasource query request/response body
fixFix: Fix redirection after login when Grafana is served from subpath
featureGo: Update to 1.24.6
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
fixAzure: Fix legend formatting
fixAzure: Fix resource name determination in template variable queries
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.3 to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureAzure Monitor: Filter namespaces by resource group
featureAzure: Add support for custom namespace and custom metrics variable queries
featureAzure: Resource picker improvements
featureAzure: Support more complex variable interpolation
featureAzure: Variable editor and resource picker improvements
featureChore: Update CVE-affected dependencies
featureDashboardScenePage: Correct slug in self referencing data links
securityDependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
featurePrometheus: Add support for cloud partners Prometheus data sources
fixInfluxDB: Fix nested variable interpolation
fixLDAP test: Fix page crash
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
fixAlerting: Fix token-based Slack image upload to work with channel names
fixAuth: Fix AzureAD config UI's ClientAuthentication dropdown
fixDashboard: Fix the unintentional time range and variables updates on saving
fixDashboards: Fix missing v/e/i keybindings to return back to dashboard
fixInfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL)
fixOrg redirection: Fix linking between orgs
featureDocker: Use our own glibc 2.40 binaries
featureTransformationFilter: Include transformation outputs in transformation filtering options
featuregrafana-ui: Update InlineField error prop type to React.ReactNode
fixAlerting: Allow specifying uid for new rules added to groups
fixAlerting: Call RLock() before reading sendAlertsTo map
fixAuth: Fix redirect with JWT auth URL login
fixAuthN: Refetch user on "ErrUserAlreadyExists"
fixAzure: Correctly set application insights resource values
fixCodeEditor: Fix cursor alignment
fixDashboardList: Throttle the re-renders
fixDashboards: Bring back scripted dashboards
fixPlugin Metrics: Eliminate data race in plugin metrics middleware
fixRBAC: Don't check folder access if annotationPermissionUpdate FT is enabled
fixCodeEditor: Fix cursor alignment
fixTransformationFilter: Include transformation outputs in transformation filtering options: Include transformation outputs in transformation filtering options
featureCloudMigration: Create authapi service
featureAlerting: Add new button for exporting new alert rule in HCL format
featureAlerting: Add option to show inactive alerts in alert list panel
featureAlerting: Add state_periodic_save_batch_size config option
featureAlerting: Change default for max_attempts to 3.
featureAlerting: Consume k8s API for notification policies tree
featureAlerting: Enable flag alertingApiServer by default
featureAlerting: Explore button in Insights view
featureAlerting: Improve performance ash page
featureAlerting: Make alert rule policies preview use k8s API
featureAlerting: Return default builtin templates in k8s templategroup API and UI
featureAlerting: Simplify notification step
featureAlerting: Update state manager to take image only once per rule evaluation
featureAnalytics Views: Deprecate :dashboardID endpoints in favor of uid/:dashboardUID (Enterprise)
featureAnalytics: Summaries: Deprecate dashboard_id endpoints in favor of dashboard_uid (Enterprise)
featureAnnouncement Banners: Enable feature for all cloud tiers (Enterprise)
featureAnnouncement banner: Remove feature toggle
featureAnnouncement banner: Remove feature toggle (Enterprise)
featureAnnouncement banner: Sort by last updated (Enterprise)
featureAuth: Return error when retries have been exhausted for OAuth token refresh
featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only
featureAzure: Improve Azure Prometheus exemplars UI/UX
featureAzure: Unify credentials in frontend for Prometheus
featureChore: Bump Go to 1.23.4
featureChore: Bump Go to 1.23.4 (Enterprise)
featureChore: Remove experimental Storage UI
featureChore: Update to node 22
featureCloudMigrations: Enable feature toggle by default in 11.5
featureCloudMigrations: Introduce RBAC role for migration assistant
featureCloudWatch: Add OpenSearch PPL and SQL support in Logs Insights
featureCloudWatch: Batch different time ranges separately
featureCloudwatch: Accept empty string for logstimeout and mark errors downstream
featureCloudwatch: Update grafana-aws-sdk for AWS/AmplifyHosting metrics
featureDashboard Scene: Shows usages in variables list
featureDashboards: Add option to specify explicit percent change text size for stat panels
featureDashboards: Allow DashboardDS subqueries in MixedDS
featureDashboards: Update docs of the overwrite param in Save Dashboard API Call
featureDatasources: Add toggle to control default behaviour of 'Manage alerts via Alerts UI' toggle
featureDatasources: Allow clearing trace to logs, metrics and profiles datasource pickers
breakingLoki: Default to /labels API with query param instead of /series API
+111 more items in the release notesfeatureGo: Update to 1.24.6
fixDashboards: Panel react for timeFrom and timeShift changes using variables
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
fixAzure: Fix legend formatting
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
featureDependencies: Bump Go to v1.24.4
securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureGo: Bump to 1.24.2 (Enterprise)
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
fixAlerting: Fix token-based Slack image upload to work with channel names
fixInfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL)
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureDocker: Use our own glibc 2.40 binaries
fixAuth: Fix redirect with JWT auth URL login
fixAuthN: Refetch user on "ErrUserAlreadyExists"
fixAzure: Correctly set application insights resource values
fixDashboards: Bring back scripted dashboards
fixPlugin Metrics: Eliminate data race in plugin metrics middleware
fixRBAC: Don't check folder access if annotationPermissionUpdate FT is enabled
featureSecurity: Update to Go 1.23.5 - Backport to v11.4.x
featureSecurity: Update to Go 1.23.5 - Backport to v11.4.x (Enterprise)
fixAlerting: AlertingQueryRunner should skip descendant nodes of invalid queries
fixAlerting: Fix alert rules unpausing after moving rule to different folder
fixAlerting: Fix label escaping in rule export
fixAlerting: Fix slack image uploading to use new api
fixAzure/GCM: Improve error display
fixDashboards: Fix issue where filtered panels would not react to variable changes
fixDashboards: Fixes issue with panel header showing even when hide time override was enabled
fixDashboards: Fixes week relative time ranges when weekStart was changed
fixDashboards: Panel react for timeFrom and timeShift changes using variables
fixDateTimePicker: Fixes issue with date picker showing invalid date
fixFix: Add support for datasource variable queries
fixInfluxDB: Adhoc filters can use template vars as values
fixLibraryPanel: Fallback to panel title if library panel title is not set
fixGrafana UI: Re-add react-router-dom as a dependency
featureCloudwatch: OpenSearch PPL and SQL support in Logs Insights
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
fixAzure: Fix legend formatting
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
featureDependencies: Bump Go to v1.24.4
securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureChore: Update libs with CVE in dependencies
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
fixAuth: Fix SAML user IsExternallySynced not being set correctly
fixAuthN: Refetch user on "ErrUserAlreadyExists"
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
fixAlerting: Fix token-based Slack image upload to work with channel names
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureDocker: Use our own glibc 2.40 binaries
fixAuth: Fix redirect with JWT auth URL login
fixAzure: Correctly set application insights resource values
fixDashboards: Bring back scripted dashboards
fixPlugin Metrics: Eliminate data race in plugin metrics middleware
featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only
featureSecurity: Update to Go 1.23.5 - Backport to v11.3.x
featureSecurity: Update to Go 1.23.5 - Backport to v11.3.x (Enterprise)
fixAlerting: AlertingQueryRunner should skip descendant nodes of invalid queries
fixAzure/GCM: Improve error display
fixDashboard: Fixes issue with compatability of old DashboardModel.annotations
fixDashboards: Fix issue where filtered panels would not react to variable changes
fixDashboards: Fixes issue with panel header showing even when hide time override was enabled
fixDashboards: Fixes week relative time ranges when weekStart was changed
fixDateTimePicker: Fixes issue with date picker showing invalid date
fixFix: Add support for datasource variable queries
fixInfluxDB: Adhoc filters can use template vars as values
fixUnified Storage: Use tls preferred when grafana db using ssl
fixGrafana UI: Re-add react-router-dom as a dependency
featureBackport: Announcement Banners: Enable feature for all cloud tiers (Enterprise)
fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
featureAlerting: Make context deadline on AlertNG service startup configurable
featureMigrationAssistant: Restrict dashboards, folders and datasources by the org id of the signed in user
featureUser: Check SignedInUser OrgID in RevokeInvite
fixAlerting: Fix escaping of silence matchers in utf8 mode
fixAlerting: Fix overflow for long receiver names
fixAlerting: Fix saving advanced mode toggle state in the alert rule editor
fixAlerting: Fix setting datasource uid, when datasource is string in old version
fixAlerting: Force refetch prom rules when refreshing panel
fixAnonymous User: Adds validator service for anonymous users
fixAnonymous User: Adds validator service for anonymous users (Enterprise)
fixAzure Monitor: Support metric namespaces fallback
fixAzure: Fix duplicated traces in multi-resource trace query
fixAzure: Handle namespace request rejection
fixCloudWatch: Interpolate region in log context query
fixDashboard datasource: Return annotations as series when query topic is "annotations"
fixDashboard: Append orgId to URL
fixDashboards: Fixes performance issue expanding a row
fixFlame Graph: Fix crash when it receives empty data
fixFolders: Add admin permissions upon creation of a folder w. SA
fixFolders: Don't show error pop-up if the user can't fetch the root folder
fixMigration: Remove table aliasing in delete statement to make it work for mariadb
fixServerLock: Fix pg concurrency/locking issue
fixService Accounts: Run service account creation in transaction
fixTable: Fix text wrapping applying to wrong field
fixUnified Storage: Use ssl_mode instead of sslmode
featureAlerting: Add manage permissions UI logic for Contact Points
featureAlerting: Allow linking to silence form with alert_rule_uid value preset
featureAlerting: Hide query name when using simplified mode in the alert rule
featureAlerting: Limit and clean up old alert rules versions
featureAlerting: Style nits for the simple query mode
featureAlerting: Update texts in annotations step
featureAlerting: Use useProduceNewAlertmanagerConfiguration for contact points
featureAuth: Attach external session info to Grafana session
featureAuth: Replace jmespath/go-jmespath with jmespath-community/go-jmespath
featureCloudMigrations: Add support for migration of Library Elements (Panels) resources
featureCloudwatch: Update grafana-aws-sdk
featureExplore Logs: Preinstall for onprem Grafana instances
featureExploreMetrics: Ensure compatibility with Incremental Querying
featureFieldConfig: Add support for Actions
featurePlugin Extensions: Require meta-data to be defined in plugin.json during development mode
featureReporting: Display template variables in the PDF (Enterprise)
featureTempo: Add deprecation notice for Aggregate By
fixAlerting/Chore: Fix TimeRangeInput not working across multiple months
fixAlerting: Fix default value for input in simple condition
fixAlerting: Fix eval interval not being saved when creating a new group
securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]
fixAlerting: Fix panics when attempting to create an Alertmanager after failing
fixDashboardScene: Fixes url issue with subpath when exiting edit mode
fixDashboards: Enable scenes by default
fixDashboards: Fixes view & edit keyboard shortcuts when grafana is behind a subpath
fixElasticSearch: Fix errorsource in newInstanceSettings
fixReporting: Fix reports on multi-org instance (Enterprise)
fixSubMenu: Fix expanding sub menu items on touch devices
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureChore: Update libs with CVE in dependencies
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
fixAuth: Fix SAML user IsExternallySynced not being set correctly
fixAuthN: Refetch user on "ErrUserAlreadyExists"
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go version to 1.23.7
featureChore: Bump Go version to 1.23.7 (Enterprise)
fixAlerting: Update slack image upload to use new API
fixCloudMigrations: Fix OrderBy clause in GetSnapshotList sql handler
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureDocker: Use our own glibc 2.40 binaries
fixAzure: Correctly set application insights resource values
featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only
featureSecurity: Update to Go 1.22.11 - Backport to v11.2.x
featureSecurity: Update to Go 1.22.11 - Backport to v11.2.x (Enterprise)
fixAzure/GCM: Improve error display
fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
featureAlerting: Make context deadline on AlertNG service startup configurable
featureMigrationAssistant: Restrict dashboards, folders and datasources by the org id of the signed in user
featureTransformations: Add 'transpose' transform
featureUser: Check SignedInUser OrgID in RevokeInvite
fixAlerting: Force refetch prom rules when refreshing panel
fixAnonymous User: Adds validator service for anonymous users
fixAnonymous User: Adds validator service for anonymous users (Enterprise)
fixAzure Monitor: Support metric namespaces fallback
fixAzure: Fix duplicated traces in multi-resource trace query
fixAzure: Handle namespace request rejection
fixFolders: Add admin permissions upon creation of a folder w. SA
fixMigration: Remove table aliasing in delete statement to make it work for mariadb
fixServerLock: Fix pg concurrency/locking issue
fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability
securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]
fixAzureMonitor: Fix App Insights portal URL for multi-resource trace queries
fixCanvas: Allow API calls to grafana origin
fixFolders: Correctly show new folder button under root folder
fixOrgSync: Do not set default Organization for a user to a non-existent Organization
fixPlugins: Skip install errors if dependency plugin already exists
fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability
featureChore: Bump Go to 1.22.7
featureChore: Bump Go to 1.22.7 (Enterprise)
featureData sources: Hide the datasource redirection banner for users who can't interact with data sources
fixAlerting: Fix preview of silences when label name contains spaces
fixAlerting: Make query wrapper match up datasource UIDs if necessary
fixAzureMonitor: Deduplicate resource picker rows
fixAzureMonitor: Improve resource picker efficiency
fixAzureMonitor: Remove Basic Logs retention warning
fixCloudWatch: Fix segfault when migrating legacy queries
fixCorrelations: Limit access to correlations page to users who can access Explore
fixDashboardScene: Fix broken error handling and error rendering
fixPlugins: Avoid returning 404 for AutoEnabled apps
featureAlerting: Support for optimistic concurrency in priovisioning Tempate API
featureLogs panel: Enable displayedFields in dashboards and apps
featureState timeline: Add pagination support
fixAuthn: No longer hash service account token twice during authentication
fixCloudMigrations: Fix snapshot creation on Windows systems
fixDashGPT: Fixes issue with generation on Safari
fixDashboard: Fix Annotation runtime error when a data source does not support annotations
fixGrafana SQL: Fix broken import in NumberInput component
fixLogs: Show older logs button when infinite scroll is enabled and sort order is descending
fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to
fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to (Enterprise)
fixReporting: Disable dashboardSceneSolo when rendering PDFs the old way (Enterprise)
fixTemplating: Fix searching non-latin template variables
fixTutorialCard: Fix link to tutorial not opening
fixAutoSizeInput: Allow to be controlled by value
feature@grafana/data: Introduce new getTagKeys/getTagValues response interface
featureAWS: Update deprecated aws-sdk functions from env variable versions
featureAlerting: Add ha_reconnect_timeout configuration option
featureAlerting: Add setting for maximum allowed rule evaluation results
featureAlerting: Add warning in telegram contact point
featureAlerting: Central alert history part4
featureAlerting: Don't crash the page when trying to filter rules by regex
featureAlerting: Enable remote primary mode using feature toggles
featureAlerting: Hide edit/view rule buttons according to deleting/creating state
featureAlerting: Implement UI for grafana-managed recording rules
featureAlerting: Improve performance of /api/prometheus for large numbers of alerts.
featureAlerting: Include a list of ref_Id and aggregated datasource UIDs to alerts when state reason is NoData
featureAlerting: Instrument outbound requests for Loki Historian and Remote Alertmanager with tracing
featureAlerting: Limit instances on alert detail view unless in instances tab
featureAlerting: Make alert group editing safer
featureAlerting: Make whitespace more visible on labels
featureAlerting: Remove option to return settings from api/v1/receivers and restrict provisioning action access
featureAlerting: Resend resolved notifications for ResolvedRetention duration
featureAlerting: Show Insights page only on cloud (when required ds's are available)
featureAlerting: Show repeat interval in timing options meta
featureAlerting: Support median in reduce expressions
featureAlerting: Track central ash interactions
featureAlerting: Update alerting state history API to authorize access using RBAC
featureAlerting: Update warning message for Telegram parse_mode and default to empty value
featureAlerting: Use Runbook URL label everywhere and add validation in the alert rule…
featureAlerting: Use cloud notifier types for metadata on Cloud AMs
featureAlerting: Use stable identifier of a group when export to HCL
featureAlerting: Use stable identifier of a group,contact point,mute timing when export to HCL
featureAlertmanager: Support limits for silences
featureAngular deprecation: Disable dynamic angular inspector if CheckForPluginUpdates is false
featureApp events: Add "info" variant
featureAuth: Add org to role mappings support to AzureAD/Entra integration
featureAuth: Add organization mapping configuration to the UI
featureAuth: Add support for escaping colon characters in org_mapping
featureAzure: Add new Azure infrastructure dashboards
featureBrowseDashboards: Update results when starred param changes
featureCaching: Handle memcached reconnects
featureCalendar: Add labels for next/previous month
featureCanvas: Element level data links
breakingFolders: Allow folder editors and admins to create subfolders without any additional permissions
+142 more items in the release notesfeatureChore: Bump Go version to 1.23.7
featureChore: Bump Go version to 1.23.7 (Enterprise)
fixAlerting: Update slack image upload to use new API
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureSecurity: Update to Go 1.22.11 - Backport to v11.1.x
featureSecurity: Update to Go 1.22.11 - Backport to v11.1.x (Enterprise)
fixAzure/GCM: Improve error display
fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
featureAlerting: Make context deadline on AlertNG service startup configurable
featureUser: Check SignedInUser OrgID in RevokeInvite
fixAlerting: Force refetch prom rules when refreshing panel
fixAnonymous User: Adds validator service for anonymous users
fixAnonymous User: Adds validator service for anonymous users (Enterprise)
fixAzure Monitor: Support metric namespaces fallback
fixAzure: Fix duplicated traces in multi-resource trace query
fixAzure: Handle namespace request rejection
fixMigration: Remove table aliasing in delete statement to make it work for mariadb
fixPrometheus: Fix interpolating adhoc filters with template variables
fixServerLock: Fix pg concurrency/locking issue
fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability
securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]
fixAzureMonitor: Fix App Insights portal URL for multi-resource trace queries
fixOrgSync: Do not set default Organization for a user to a non-existent Organization
fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability
featureChore: Bump Go to 1.22.7
featureChore: Bump Go to 1.22.7 (Enterprise)
fixAlerting: Fix preview of silences when label name contains spaces
fixAlerting: Make query wrapper match up datasource UIDs if necessary
fixAzureMonitor: Deduplicate resource picker rows
fixAzureMonitor: Improve resource picker efficiency
fixAzureMonitor: Remove Basic Logs retention warning
fixCorrelations: Limit access to correlations page to users who can access Explore
fixPlugins: Avoid returning 404 for AutoEnabled apps
securityAlerting: Fixed CVE-2024-8118.
featureChore: Update swagger ui (4.3.0 to 5.17.14)
fixTemplating: Fix searching non-latin template variables
fixTutorialCard: Fix link to tutorial not opening
fixBugfix: QueryField typeahead missing background color
fixAlerting: Fix permissions for prometheus rule endpoints
fixAlerting: Fix persisting result fingerprint that is used by recovery threshold
fixAuditing: Fix a possible crash when audit logger parses responses for failed requests (Enterprise)
fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to
fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they dont belong to (Enterprise)
fixRBAC: Fix seeder failures when inserting duplicated permissions (Enterprise)
fixSnapshots: Fix panic when snapshot_remove_expired is true
fixVizTooltip: Fix positioning at bottom and right edges on mobile
fixBugfix: QueryField typeahead missing background color
securitySwagger: Fixed CVE-2024-6837.
fixRBAC: Allow plugins to use scoped actions