Grafana 11.3.0 → 11.6.15
45 releases · 2 breaking changes · 62 security fixes · 14 advisories fixed
62security2breaking0deprecated168feature122fix
Vulnerabilities fixed by this upgrade
- 7.5 CVE-2026-42127 The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON p…
- 6.5 CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them.
- 6.5 CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
- 7.4 CVE-2026-33376 When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
- 7.1 CVE-2026-33377 An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
- 6.5 CVE-2026-33378 Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
- 4.3 CVE-2026-28374 Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
- 6.5 CVE-2026-28376 The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
- 6.5 CVE-2026-28379 A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
- 3.3 CVE-2026-21727 A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
- 5.3 CVE-2026-21722 Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi…
- 7.5 CVE-2026-21720 Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops…
- 8.1 CVE-2026-21721 The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa…
- 7.6 CVE-2025-4123 A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
Breaking changes
- breaking Data source: Change Permissions for query to only have query and not read OR query (Enterprise) in 11.6.0
- breaking Loki: Default to /labels API with query param instead of /series API in 11.5.0
Security changes
- security Security: CVE-2026-33382 in 11.6.15
- security Security: CVE-2026-42127 in 11.6.15
- security Security: CVE-2026-42129 in 11.6.15
- security Security: CVE-2026-10601 in 11.6.15
- security Security: CVE-2026-8609 in 11.6.15
- security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 11.6.14
- security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 11.6.14
- security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 11.6.14
- security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 11.6.14
- security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 11.6.14
- security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 11.6.14
- security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 11.6.14
- security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 11.6.14
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 11.6.14
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 11.6.14
- security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 11.6.14
- security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 11.6.14
- security Security: Fix CVE-2026-27876 in 11.6.14
- security Security: Fix CVE-2026-27877 in 11.6.14
- security Security: Fix CVE-2026-28375 in 11.6.14
- security Security: Fix CVE-2026-27879 in 11.6.14
- security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 11.6.11
- security Fixes CVE-2026-21722: Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi… in 11.6.10
- security Fixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa… in 11.6.9
- security Fixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… in 11.6.9
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.6.4
- security Security: Fixes CVE-2025-3415 in 11.6.3
- security Security: Fix CVE-2025-3454 in 11.6.2
- security Security: Fix CVE-2025-2703 in 11.6.2
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.6.1
- security Chore: Update JWT library (CVE-2025-30204) in 11.6.1
- security Dependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923 in 11.6.1
- security Security: Fix CVE-2025-3454 in 11.6.1
- security Security: Fix CVE-2025-2703 in 11.6.1
- security Security: Fix CVE-2025-3260 in 11.6.1
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 11.6.0
- security Chore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786 in 11.6.0
- security App Platform: Pin bleve to fix CVE-2022-31022 in 11.6.0
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.5.7
- security Security: Fixes CVE-2025-3415 in 11.5.6
- security Security: Fix CVE-2025-3454 in 11.5.5
- security Security: Fix CVE-2025-2703 in 11.5.5
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.5.4
- security Dependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923 in 11.5.4
- security Security: Fix CVE-2025-3454 in 11.5.4
- security Security: Fix CVE-2025-2703 in 11.5.4
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.4.7
- security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 11.4.6
- security Security: Fixes CVE-2025-3415 in 11.4.6
- security Security: Fix CVE-2025-3454 in 11.4.5
- security Security: Fix CVE-2025-2703 in 11.4.5
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.4.4
- security Security: Fix CVE-2025-3454 in 11.4.4
- security Security: Fix CVE-2025-2703 in 11.4.4
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.3.9
- security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 11.3.8
- security Security: Fixes CVE-2025-3415 in 11.3.8
- security Security: Fix CVE-2025-3454 in 11.3.7
- security Security: Fix CVE-2025-2703 in 11.3.7
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.3.6
- security Security: Fix CVE-2025-3454 in 11.3.6
- security Security: Fix CVE-2025-2703 in 11.3.6
Every release in between
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
fixDashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securityFixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
securityFixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.
securityFixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
securityFixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
securityFixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
securityFixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
securityFixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr…
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
securityFixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re…
securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
securitySecurity: Fix CVE-2026-27876
securitySecurity: Fix CVE-2026-27877
securitySecurity: Fix CVE-2026-28375
securitySecurity: Fix CVE-2026-27879
featureGo: Update to 1.25.8
securityFixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
featureAlerting: Add limits for the size of expanded notification templates
featureCorrelations: Remove support for org_id=0
featureGo: Update to 1.25.7
featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled
securityFixes CVE-2026-21722: Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi…
featureAPI: Add missing scope check on dashboards
featureAvatar: Require sign-in, remove queue, respect timeout
featureGo: Update to 1.25.6
fixAlerting: Fix a race condition panic in ResetStateByRuleUID
securityFixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa…
securityFixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops…
featureAlerting: Update alerting dependency
featureDependencies: Bump Go to v1.25.5
featurePDFTables: Dynamically shrink font to try and fit whole table in pdf page width (Enterprise)
featurePlugins: Add PluginContext to plugins when scenes is disabled
fixAlerting: Fix contacts point issues
fixAlerting: Fix unmarshalling of GettableStatus to include time intervals
fixAnalyticsSummaries: Fix dashboard rollup not resetting "last X days" metrics to zero (Enterprise)
fixAnalyticsSummaries: Fix dashboard rollup totals resetting incorrectly (Enterprise)
fixSeeder: Add check in filterRemovedPermissions for already existing new permissions before seeding (Enterprise)
featureAnalytics: Apply proper batching to Loki exports and add configurable settings (Enterprise)
featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0
featureGo: Update to 1.25.3
fixAuth: Fix render user OAuth passthrough
fixLDAP Authentication: Fix URL to propagate username context as parameter
fixPlugins: Dependencies do not inherit parent URL for preinstall
fixURLParams: Stringify true values as key=true always (fixes issues with variables with true value)
featureAlerting: Update alerting module
featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)
featureAuditing: Document new options for recording datasource query request/response body
fixAlerting: Fix copying of recording rule fields
fixFix: Fix redirection after login when Grafana is served from subpath
featureAlerting: Bump alerting package to include change to NewTLSClient
featureGo: Update to 1.24.6
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
featureStateTimeline: Add endTime to tooltip
featureUnified storage: Respect GF_DATABASE_URL override
fixAlerting: Fix group interval override when adding new rules
fixAzure: Fix legend formatting
fixAzure: Fix resource name determination in template variable queries
fixGraphite: Fix annotation queries
fixGraphite: Fix date mutation
fixGraphite: Fix nested variable interpolation for repeated rows
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.4-git to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.6 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0
fixDashboard: Fixes issue with row repeats and first row
fixGraphite: Ensure template variables are interpolated correctly
fixGraphite: Fix Graphite series interpolation
fixPrometheus: Fix semver import path
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
securityChore: Update JWT library (CVE-2025-30204)
featureDashboardScenePage: Correct slug in self referencing data links
securityDependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
featureGrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
featurePrometheus: Add support for cloud partners Prometheus data sources
fixAlertmanager: Add Role-Based Access Control via reqAction Field
fixGrafanaUI: Remove blurred background from overlay backdrops to improve performance
fixInfluxDB: Fix nested variable interpolation
fixLDAP test: Fix page crash
fixOrg redirection: Fix linking between orgs
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securitySecurity: Fix CVE-2025-3260
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
featureAPI keys: Migrate API keys to service accounts at startup
featureAccessControl: Allow plugin roles to include plugins:write
featureAlerting: Add DAG errors to alert rule creation and view
featureAlerting: Add Jira integration to cloud AMs
featureAlerting: Add alert rule version history - part1
featureAlerting: Add migration to clean up rule versions table
featureAlerting: Add multiple threshold operators
featureAlerting: Add tracking for the mode used in query and notifications step when c…
featureAlerting: Adding color option for slack receiver
featureAlerting: Allow selection of recording rule write target on per-rule basis.
featureAlerting: Allow specifying uid for new rules added to groups
featureAlerting: Improve template testing by trying non-root scopes
featureAlerting: Include time range in template dashboard and panel urls
featureAlerting: Keep the latest version of deleted rule in version table
featureAlerting: Promote alertingSaveStateCompressed flag to public preview
featureAlerting: Remove ID and OrgID from hash calculation
featureAlerting: Remove feature toggle alertingNoNormalState
featureAlerting: Remove rule group edit from single rule editor
featureAlerting: Return 404 when /api/ruler/grafana/api/v1/rules/{Namespace}/{Groupname} does not exist
featureAlerting: Rule history restore feature
featureAlerting: Support Jira Integration
featureAlerting: Track if new gm rules are created with queries and expressions transformable to simple mode
featureAlerting: Update IRM copies in Configuration Tracker
featureAlerting: Update design of rule details tab and add updated by
featureAlerting: Update irm links for incident and oncall in case new irm plugin is present
featureAlerting: Use exponential backoff in the remote Alertmanager readiness check
featureAlerting: Use uid instead of id in AnnotationsStateHistory
featureAuth: Add IP address login attempt validation
featureAuth: Add support for the TlsSkipVerify parameter to JWT Auth
featureAuth: Make ssoSettingsSAML GA and enabled by default
featureAzure Monitor: Filter namespaces by resource group
featureAzure: Resource picker improvements
featureAzure: Variable editor and resource picker improvements
featureBadge: Add darkgrey color
featureCanvas: One click links and actions
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
securityChore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786
securityApp Platform: Pin bleve to fix CVE-2022-31022
+105 more items in the release notesfeatureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0
featureGo: Update to 1.25.3
fixAuth: Fix render user OAuth passthrough
fixLDAP Authentication: Fix URL to propagate username context as parameter
fixPlugins: Dependencies do not inherit parent URL for preinstall
featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)
featureAuditing: Document new options for recording datasource query request/response body
fixFix: Fix redirection after login when Grafana is served from subpath
featureGo: Update to 1.24.6
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
fixAzure: Fix legend formatting
fixAzure: Fix resource name determination in template variable queries
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.3 to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureAzure Monitor: Filter namespaces by resource group
featureAzure: Add support for custom namespace and custom metrics variable queries
featureAzure: Resource picker improvements
featureAzure: Support more complex variable interpolation
featureAzure: Variable editor and resource picker improvements
featureChore: Update CVE-affected dependencies
featureDashboardScenePage: Correct slug in self referencing data links
securityDependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
featurePrometheus: Add support for cloud partners Prometheus data sources
fixInfluxDB: Fix nested variable interpolation
fixLDAP test: Fix page crash
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
fixAlerting: Fix token-based Slack image upload to work with channel names
fixAuth: Fix AzureAD config UI's ClientAuthentication dropdown
fixDashboard: Fix the unintentional time range and variables updates on saving
fixDashboards: Fix missing v/e/i keybindings to return back to dashboard
fixInfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL)
fixOrg redirection: Fix linking between orgs
featureDocker: Use our own glibc 2.40 binaries
featureTransformationFilter: Include transformation outputs in transformation filtering options
featuregrafana-ui: Update InlineField error prop type to React.ReactNode
fixAlerting: Allow specifying uid for new rules added to groups
fixAlerting: Call RLock() before reading sendAlertsTo map
fixAuth: Fix redirect with JWT auth URL login
fixAuthN: Refetch user on "ErrUserAlreadyExists"
fixAzure: Correctly set application insights resource values
fixCodeEditor: Fix cursor alignment
fixDashboardList: Throttle the re-renders
fixDashboards: Bring back scripted dashboards
fixPlugin Metrics: Eliminate data race in plugin metrics middleware
fixRBAC: Don't check folder access if annotationPermissionUpdate FT is enabled
fixCodeEditor: Fix cursor alignment
fixTransformationFilter: Include transformation outputs in transformation filtering options: Include transformation outputs in transformation filtering options
featureCloudMigration: Create authapi service
featureAlerting: Add new button for exporting new alert rule in HCL format
featureAlerting: Add option to show inactive alerts in alert list panel
featureAlerting: Add state_periodic_save_batch_size config option
featureAlerting: Change default for max_attempts to 3.
featureAlerting: Consume k8s API for notification policies tree
featureAlerting: Enable flag alertingApiServer by default
featureAlerting: Explore button in Insights view
featureAlerting: Improve performance ash page
featureAlerting: Make alert rule policies preview use k8s API
featureAlerting: Return default builtin templates in k8s templategroup API and UI
featureAlerting: Simplify notification step
featureAlerting: Update state manager to take image only once per rule evaluation
featureAnalytics Views: Deprecate :dashboardID endpoints in favor of uid/:dashboardUID (Enterprise)
featureAnalytics: Summaries: Deprecate dashboard_id endpoints in favor of dashboard_uid (Enterprise)
featureAnnouncement Banners: Enable feature for all cloud tiers (Enterprise)
featureAnnouncement banner: Remove feature toggle
featureAnnouncement banner: Remove feature toggle (Enterprise)
featureAnnouncement banner: Sort by last updated (Enterprise)
featureAuth: Return error when retries have been exhausted for OAuth token refresh
featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only
featureAzure: Improve Azure Prometheus exemplars UI/UX
featureAzure: Unify credentials in frontend for Prometheus
featureChore: Bump Go to 1.23.4
featureChore: Bump Go to 1.23.4 (Enterprise)
featureChore: Remove experimental Storage UI
featureChore: Update to node 22
featureCloudMigrations: Enable feature toggle by default in 11.5
featureCloudMigrations: Introduce RBAC role for migration assistant
featureCloudWatch: Add OpenSearch PPL and SQL support in Logs Insights
featureCloudWatch: Batch different time ranges separately
featureCloudwatch: Accept empty string for logstimeout and mark errors downstream
featureCloudwatch: Update grafana-aws-sdk for AWS/AmplifyHosting metrics
featureDashboard Scene: Shows usages in variables list
featureDashboards: Add option to specify explicit percent change text size for stat panels
featureDashboards: Allow DashboardDS subqueries in MixedDS
featureDashboards: Update docs of the overwrite param in Save Dashboard API Call
featureDatasources: Add toggle to control default behaviour of 'Manage alerts via Alerts UI' toggle
featureDatasources: Allow clearing trace to logs, metrics and profiles datasource pickers
breakingLoki: Default to /labels API with query param instead of /series API
+111 more items in the release notesfeatureGo: Update to 1.24.6
fixDashboards: Panel react for timeFrom and timeShift changes using variables
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
fixAzure: Fix legend formatting
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
featureDependencies: Bump Go to v1.24.4
securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureGo: Bump to 1.24.2 (Enterprise)
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
fixAlerting: Fix token-based Slack image upload to work with channel names
fixInfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL)
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureDocker: Use our own glibc 2.40 binaries
fixAuth: Fix redirect with JWT auth URL login
fixAuthN: Refetch user on "ErrUserAlreadyExists"
fixAzure: Correctly set application insights resource values
fixDashboards: Bring back scripted dashboards
fixPlugin Metrics: Eliminate data race in plugin metrics middleware
fixRBAC: Don't check folder access if annotationPermissionUpdate FT is enabled
featureSecurity: Update to Go 1.23.5 - Backport to v11.4.x
featureSecurity: Update to Go 1.23.5 - Backport to v11.4.x (Enterprise)
fixAlerting: AlertingQueryRunner should skip descendant nodes of invalid queries
fixAlerting: Fix alert rules unpausing after moving rule to different folder
fixAlerting: Fix label escaping in rule export
fixAlerting: Fix slack image uploading to use new api
fixAzure/GCM: Improve error display
fixDashboards: Fix issue where filtered panels would not react to variable changes
fixDashboards: Fixes issue with panel header showing even when hide time override was enabled
fixDashboards: Fixes week relative time ranges when weekStart was changed
fixDashboards: Panel react for timeFrom and timeShift changes using variables
fixDateTimePicker: Fixes issue with date picker showing invalid date
fixFix: Add support for datasource variable queries
fixInfluxDB: Adhoc filters can use template vars as values
fixLibraryPanel: Fallback to panel title if library panel title is not set
fixGrafana UI: Re-add react-router-dom as a dependency
featureCloudwatch: OpenSearch PPL and SQL support in Logs Insights
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
fixAzure: Fix legend formatting
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
featureDependencies: Bump Go to v1.24.4
securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureChore: Update libs with CVE in dependencies
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
fixAuth: Fix SAML user IsExternallySynced not being set correctly
fixAuthN: Refetch user on "ErrUserAlreadyExists"
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
fixAlerting: Fix token-based Slack image upload to work with channel names
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureDocker: Use our own glibc 2.40 binaries
fixAuth: Fix redirect with JWT auth URL login
fixAzure: Correctly set application insights resource values
fixDashboards: Bring back scripted dashboards
fixPlugin Metrics: Eliminate data race in plugin metrics middleware
featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only
featureSecurity: Update to Go 1.23.5 - Backport to v11.3.x
featureSecurity: Update to Go 1.23.5 - Backport to v11.3.x (Enterprise)
fixAlerting: AlertingQueryRunner should skip descendant nodes of invalid queries
fixAzure/GCM: Improve error display
fixDashboard: Fixes issue with compatability of old DashboardModel.annotations
fixDashboards: Fix issue where filtered panels would not react to variable changes
fixDashboards: Fixes issue with panel header showing even when hide time override was enabled
fixDashboards: Fixes week relative time ranges when weekStart was changed
fixDateTimePicker: Fixes issue with date picker showing invalid date
fixFix: Add support for datasource variable queries
fixInfluxDB: Adhoc filters can use template vars as values
fixUnified Storage: Use tls preferred when grafana db using ssl
fixGrafana UI: Re-add react-router-dom as a dependency
featureBackport: Announcement Banners: Enable feature for all cloud tiers (Enterprise)
fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
featureAlerting: Make context deadline on AlertNG service startup configurable
featureMigrationAssistant: Restrict dashboards, folders and datasources by the org id of the signed in user
featureUser: Check SignedInUser OrgID in RevokeInvite
fixAlerting: Fix escaping of silence matchers in utf8 mode
fixAlerting: Fix overflow for long receiver names
fixAlerting: Fix saving advanced mode toggle state in the alert rule editor
fixAlerting: Fix setting datasource uid, when datasource is string in old version
fixAlerting: Force refetch prom rules when refreshing panel
fixAnonymous User: Adds validator service for anonymous users
fixAnonymous User: Adds validator service for anonymous users (Enterprise)
fixAzure Monitor: Support metric namespaces fallback
fixAzure: Fix duplicated traces in multi-resource trace query
fixAzure: Handle namespace request rejection
fixCloudWatch: Interpolate region in log context query
fixDashboard datasource: Return annotations as series when query topic is "annotations"
fixDashboard: Append orgId to URL
fixDashboards: Fixes performance issue expanding a row
fixFlame Graph: Fix crash when it receives empty data
fixFolders: Add admin permissions upon creation of a folder w. SA
fixFolders: Don't show error pop-up if the user can't fetch the root folder
fixMigration: Remove table aliasing in delete statement to make it work for mariadb
fixServerLock: Fix pg concurrency/locking issue
fixService Accounts: Run service account creation in transaction
fixTable: Fix text wrapping applying to wrong field
fixUnified Storage: Use ssl_mode instead of sslmode