Grafana 12.1.10 → 13.3.0
67 releases · 13 breaking changes · 189 security fixes · 10 advisories fixed
189security13breaking0deprecated334feature83fix
Vulnerabilities fixed by this upgrade
- 6.5 CVE-2026-33378 Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
- 6.5 CVE-2026-28376 The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
- 6.5 CVE-2025-12141 In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as p…
- 6.5 CVE-2026-27877 When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco…
- 6.5 CVE-2026-27879 A resample query can be used to trigger out-of-memory crashes in Grafana.
- 7.5 CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
- 6.5 CVE-2026-28375 A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
- 9.1 CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
- 2.6 CVE-2026-21725 A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions…
- 10.0 CVE-2025-41115 SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.…
Breaking changes
- breaking Plugins marketplace: rename config.ini section from marketplace to plugins_marketplace in 13.3.0
- breaking Alerting: Remove alertingSaveStateCompressed feature flag in 13.2.0
- breaking Prometheus: Remove azure and sigv4 auth from core prometheus in 13.1.0
- breaking Prometheus: Remove grafana-prometheus package#122953 in 13.1.0
- breaking Zipkin: Remove from core plugins in 13.1.0
- breaking Plugins: Prevent passing host environment variables to plugin processes by default in 12.4.0
- breaking Faro: Update configuration with best practices in 12.3.0
- breaking LibraryPanels: Remove unique name constraints in 12.3.0
- breaking RBAC: Only write action sets in 12.3.0
- breaking Alerting: Enable alertingSaveStateCompressed by default in 12.2.0
- breaking Dashboards: Repeating with no clone keys in 12.2.0
- breaking Provisioning: Use inline secrets for gitsync in 12.2.0
- breaking Stars: Remove deprecated internal ID apis in 12.2.0
Security changes
- security Security: Fix CVE-2026-100105 in 13.3.0
- security Security: Fix CVE-2026-13719 in 13.3.0
- security Security: Fix CVE-2026-13720 in 13.3.0
- security Security: Fix CVE-2026-15577 in 13.3.0
- security Security: Fix CVE-2026-33374 in 13.3.0
- security Security: Fix CVE-2026-81841 in 13.3.0
- security Security: Fix CVE-2026-88858 in 13.3.0
- security Security: Fix CVE-2026-88967 in 13.3.0
- security Security: Fix CVE-2026-93294 in 13.3.0
- security Security: Fix CVE-2026-95502 in 13.3.0
- security Security: Fix CVE-2026-17183 in 13.3.0
- security Security: Fix CVE-2026-100105 in 13.2.5
- security Security: Fix CVE-2026-103506 in 13.2.5
- security Security: Fix CVE-2026-88858 in 13.2.5
- security Security: Fix CVE-2026-88967 in 13.2.5
- security Security: Fix CVE-2026-15577 in 13.2.4
- security Security: Fix CVE-2026-33374 in 13.2.4
- security Security: Fix CVE-2026-93294 in 13.2.4
- security Security: Fix CVE-2026-95502 in 13.2.4
- security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.2.4
- security Security: Fix CVE-2026-13719 in 13.2.3
- security Security: Fix CVE-2026-13720 in 13.2.3
- security Security: Fix CVE-2026-81841 in 13.2.3
- security Security: Fix CVE-2026-15815 in 13.2.2
- security Security: Fix CVE-2026-76154 in 13.2.2
- security Security: Fix CVE-2026-79656 in 13.2.2
- security Security: Fix CVE-2026-12704 in 13.2.1
- security Security: Fix CVE-2026-14199 in 13.2.1
- security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.2.0
- security CVE-2026-17183 in 13.2.0
- security Security: Fix CVE-2026-100105 in 13.1.9
- security Security: Fix CVE-2026-88858 in 13.1.9
- security Security: Fix CVE-2026-88967 in 13.1.9
- security Security: Fix CVE-2026-15577 in 13.1.8
- security Security: Fix CVE-2026-33374 in 13.1.8
- security Security: Fix CVE-2026-93294 in 13.1.8
- security Security: Fix CVE-2026-95502 in 13.1.8
- security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.1.8
- security Security: Fix CVE-2026-13719 in 13.1.7
- security Security: Fix CVE-2026-13720 in 13.1.7
- security Security: Fix CVE-2026-81841 in 13.1.7
- security Security: Fix CVE-2026-15815 in 13.1.6
- security Security: Fix CVE-2026-76154 in 13.1.6
- security Security: Fix CVE-2026-79656 in 13.1.6
- security Security: Fix CVE-2026-12704 in 13.1.5
- security Security: Fix CVE-2026-14199 in 13.1.5
- security Security: Fix CVE-2026-19475 in 13.1.5
- security CVE-2026-17183 in 13.1.4
- security Security: Fix CVE-2026-13438 in 13.1.2
- security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.1.0
- security Security: Fix CVE-2026-100105 in 13.0.12
- security Security: Fix CVE-2026-88858 in 13.0.12
- security Security: Fix CVE-2026-88967 in 13.0.12
- security Security: Fix CVE-2026-15577 in 13.0.11
- security Security: Fix CVE-2026-33374 in 13.0.11
- security Security: Fix CVE-2026-93294 in 13.0.11
- security Security: Fix CVE-2026-95502 in 13.0.11
- security CVE-2026-92539: IAM: Fix: Scim endpoints (Enterprise) in 13.0.11
- security Security: Fix CVE-2026-13719 in 13.0.10
- security Security: Fix CVE-2026-13720 in 13.0.10
- security Security: Fix CVE-2026-81841 in 13.0.10
- security Security: Fix CVE-2026-81842 in 13.0.10
- security Security: Fix CVE-2026-15815 in 13.0.9
- security Security: Fix CVE-2026-76154 in 13.0.9
- security Security: Fix CVE-2026-79656 in 13.0.9
- security Security: Fix CVE-2026-12704 in 13.0.8
- security Security: Fix CVE-2026-14199 in 13.0.8
- security Security: Fix CVE-2026-19475 in 13.0.8
- security CVE-2026-17183 in 13.0.7
- security Security: CVE-2026-9029 in 13.0.2
- security Security: CVE-2026-33382 in 13.0.2
- security Security: CVE-2026-42127 in 13.0.2
- security Security: CVE-2026-42129 in 13.0.2
- security Security: CVE-2026-10601 in 13.0.2
- security Security: CVE-2026-8609 in 13.0.2
- security Security: CVE-2026-8595 in 13.0.2
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 13.0.1
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 13.0.1
- security Security: Fix CVE-2026-100105 in 12.4.14
- security Security: Fix CVE-2026-88858 in 12.4.14
- security Security: Fix CVE-2026-88967 in 12.4.14
- security Security: Fix CVE-2026-15577 in 12.4.13
- security Security: Fix CVE-2026-33374 in 12.4.13
- security Security: Fix CVE-2026-93294 in 12.4.13
- security CVE-2026-92539: IAM: Fix CVE-2026-92539: Scim endpoints (Enterprise) in 12.4.13
- security Security: Fix CVE-2026-13719 in 12.4.12
- security Security: Fix CVE-2026-13720 in 12.4.12
- security Security: Fix CVE-2026-81841 in 12.4.12
- security Security: Fix CVE-2026-81842 in 12.4.12
- security Security: Fix CVE-2026-12704 in 12.4.11
- security Security: Fix CVE-2026-15815 in 12.4.11
- security Security: Fix CVE-2026-76154 in 12.4.11
- security Security: Fix CVE-2026-79656 in 12.4.11
- security Security: Fix CVE-2026-14199 in 12.4.10
- security Security: Fix CVE-2026-19475 in 12.4.10
- security CVE-2026-17183 in 12.4.9
- security Security: CVE-2026-9029 in 12.4.4
- security Security: CVE-2026-33382 in 12.4.4
- security Security: CVE-2026-42127 in 12.4.4
- security Security: CVE-2026-42129 in 12.4.4
- security Security: CVE-2026-10601 in 12.4.4
- security Security: CVE-2026-8609 in 12.4.4
- security Security: CVE-2026-8595 in 12.4.4
- security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.4.3
- security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.4.3
- security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.4.3
- security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.4.3
- security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.4.3
- security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.4.3
- security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.4.3
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.4.3
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.4.3
- security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.4.3
- security Security: Fixes CVE-2026-27876 in 12.4.2
- security Security: Fixes CVE-2026-27877 in 12.4.2
- security Security: Fixes CVE-2026-28375 in 12.4.2
- security Security: Fixes CVE-2026-27879 in 12.4.2
- security Security: Fixes CVE-2026-27880 in 12.4.2
- security Security: Fixes CVE-2026-33375 in 12.4.2
- security Fixes CVE-2026-21725: A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions… in 12.4.1
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.4.0
- security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.4.0
- security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.4.0
- security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.4.0
- security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.4.0
- security CVE-2026-17183 in 12.3.11
- security Security: CVE-2026-33382 in 12.3.7
- security Security: CVE-2026-42127 in 12.3.7
- security Security: CVE-2026-42129 in 12.3.7
- security Security: CVE-2026-10601 in 12.3.7
- security Security: CVE-2026-8609 in 12.3.7
- security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.3.6
- security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.3.6
- security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.3.6
- security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.3.6
- security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.3.6
- security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.3.6
- security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.3.6
- security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 12.3.6
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.3.6
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.3.6
- security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 12.3.6
- security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.3.6
- security Security: Fixes CVE-2026-27876 in 12.3.6
- security Security: Fixes CVE-2026-27877 in 12.3.6
- security Security: Fixes CVE-2026-28375 in 12.3.6
- security Security: Fixes CVE-2026-27879 in 12.3.6
- security Security: Fixes CVE-2026-27880 in 12.3.6
- security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 12.3.3
- security Fixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack… in 12.3.2
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.3.0
- security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.3.0
- security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.3.0
- security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.3.0
- security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.3.0
- security Security: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise) in 12.3.0
- security Security: CVE-2026-33382 in 12.2.9
- security Security: CVE-2026-42127 in 12.2.9
- security Security: CVE-2026-42129 in 12.2.9
- security Security: CVE-2026-10601 in 12.2.9
- security Security: CVE-2026-8609 in 12.2.9
- security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.2.8
- security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.2.8
- security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.2.8
- security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.2.8
- security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.2.8
- security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.2.8
- security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.2.8
- security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 12.2.8
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.2.8
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.2.8
- security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 12.2.8
- security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.2.8
- security Security: Fixes CVE-2026-27876 in 12.2.8
- security Security: Fixes CVE-2026-27877 in 12.2.8
- security Security: Fixes CVE-2026-28375 in 12.2.8
- security Security: Fixes CVE-2026-27879 in 12.2.8
- security Security: Fixes CVE-2026-27880 in 12.2.8
- security Fixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack… in 12.2.4
- security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 12.2.4
- security Fixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa… in 12.2.3
- security Fixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… in 12.2.3
- security Security: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise) in 12.2.2
- security Fixes CVE-2025-41115: SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.… in 12.2.1
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.2.0
- security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.2.0
- security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.2.0
- security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.2.0
- security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.2.0
Every release in between
securitySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAccess control: reject global role creation in single-org mode (Enterprise)
featureAlerting: Add AccessControlAction entries for inhibition rules
featureAlerting: Add notifications API boundary module
featureAlerting: Add the Config API data layer for external Alertmanager auto-sync
featureAlerting: Allow drag and drop for yaml file as import source for import wizard
featureAlerting: Cleanup promote staged config code
featureAlerting: Disable datasource picker while an import is staged
featureAlerting: Make stage default import method in GMA import wizard
featureAlerting: Make the Import wizard review step preview look clickable
featureAlerting: Migrate the Import-to-GMA wizard's auto-sync integration
featureAlerting: Migrate the auto-sync settings hook and panel onto the Config API
featureAlerting: Promote AlertRule, RecordingRule and RuleSequence to v1beta1
featureAlerting: Promote a staged import configuration
featureAlerting: Read staged config origin from the managed_by field
featureAlerting: Redact secrets from the Import-to-GMA preview modal
featureAlerting: Refactor useIsAutoSyncActive onto the shared Config-API helpers
featureAlerting: Remove import method from import to GMA wizard
featureAlerting: Retire the legacy admin_config auto-sync path
featureAlerting: Show Auto-sync support in the import wizard picker
featureAlerting: Support Mimir alertmanager_config files in Import to GMA wizard
featureAlerting: Surface external Alertmanager sync health in the settings UI
featureAlerting: stop auto-sync from force-skipping the Rules step in the GMA import wizard
featureAuth: Bound OAuth token refresh lock waits by time instead of attempts
featureCanvas: Load the standalone plugin by default
featureChore: Upgrade to k8s v0.37.0 (and grafana-app-sdk v0.60.0)
featureDashboard: Adds new a subtitle option for panel descriptions
featureDashboard: Fall back when collection deletion is unsupported
featureDashboards: Add $__namespace global variable
securitySecurity: Fix CVE-2026-17183
breakingPlugins marketplace: rename config.ini section from marketplace to plugins_marketplace
+123 more items in the release notessecuritySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-103506
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
featureGit Sync: Ignore hidden paths in repository scans and diffs
featureProvisioning: Default save from a branch preview to the previewed branch
featureProvisioning: Never replace the repository root folder during incremental sync
fixPlugins: Don't report loaded plugins as not registered when a request times out
fixProvisioning: Fix PR dashboard previews when served from a sub-path
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported
featureGit Sync: Clarify repository links for pure Git
featureProvisioning: Allow resource previews in unsynced folders
featureProvisioning: Reject invalid resource names before API calls
featureProvisioning: Show last checked time in Pull status
featureProvisioning: Skip previews for pull requests from forks
featureProvisioning: Stop PR previews when refs disappear
featureProvisioning: Support legacy paths and diagnose missing source annotations
featureProvisioning: write terminal sync status back to repository on early sync-job failures and Respect Git Sync polling intervals after unchanged refs
securityCVE-2026-92539: IAM: Fix: SCIM (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
fixProvisioning: Fix folder rename UID collision during full sync
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
fixDashboards: Fix adhoc and groupby variable datasource on UI import
fixPackaging: Fix issue with bundled plugins not being moved properly
fixPanelEditor: Fix options pane not resizable beyond the preview's content width
securityFixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…
securityCVE-2026-17183
featureAlerting: Add Import tab in alerting settings page
featureAlerting: Add notification template import to the import-to-GMA wizard
featureAlerting: Add promote and auto sync to ImportToGMAWizard
featureAlerting: Add staged configuration summary in import settings page
featureAlerting: Compute staged config origin server-side
featureAlerting: Migrate notifications API to v1beta1
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (1/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (2/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (3/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (4/4)
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureAlerting: Revert a staged import configuration
featureAlerting: Show unusable time intervals as disabled in the mute timings selector
featureAlerting: Track import method analytics in import to gma
featureAlerting: remove AlertingCentralHistory FT
featureAnalytics: Add public dashboard UID to loki usage insights events (Enterprise)
featureAuditing: Record the user name on user deletion audit logs (Enterprise)
featureAzure Monitor: Cache subscription lookups and collapse double Unmarshal in buildQuery
featureAzure monitor: Azure Metrics Batch API Implementation backend
featureCloudWatch Logs: Add frontend support for querying by data source
featureColorScale: Remove live hoverValue, remove from HeatMap tooltip
featureDashList: Show dashboard description tooltip when it's available
featureDashboard: redirect from dashboard settings tabs to sidebar counterparts
featureDashboards: Allow threshold interpolation
featureDashboards: Deprecate scripted dashboards and disable them by default
featureDashboards: Enable new view panel controls by default
featureDashboards: Increase nesting depth to 4 and allow nested tabs
featureDashboards: Show panel query errors and notices in one UI
featureDeveloper Guide: Add note about requiring signed commits
featureDocs: document the tracing file exporter
featureExplore Logs: log line highlight color lighten in dark, update deprecated pinned color
featureFolder API: Replace legacy access control logic with app platform API call
featureGo: Update version to 1.26.5
featureGrafanaUI: Add real magnification effect to GrotNotFound lens
featureHome: Enable unified homepage for all users (remove flag)
featureLive: Support redis:// and rediss:// (TLS) connection URLs in ha_engine_address
featureLogs: Add more suggested fields and integrate with the new Logs Table
featureLogs: use gray (dimgray) for debug level color
+122 more items in the release notessecuritySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
featureProvisioning: Default save from a branch preview to the previewed branch
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported
securityCVE-2026-92539: IAM: Fix: SCIM (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
fixProvisioning: Fix folder rename UID collision during full sync
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
securitySecurity: Fix CVE-2026-19475
securityCVE-2026-17183
fixReporting: batch dashboard lookups when listing reports (Enterprise)
fixLogs Table: Fix missing results when logs stream
fixLogs Table: Fix mixed usage of field name and display name
securitySecurity: Fix CVE-2026-13438
featureGo: Update version to 1.26.5
featureProvisioning: Improve form errors for github connections
featureProvisioning: make sync per-resource write timeout configurable
fixAccessibility: Ensure InlineToast contents are announced by screenreaders
fixDashboardDS: Fix chained dashboard datasource panels showing stale data
fixProvisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422)
fixPagination: Set aria-current on active page
securityFixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…
featureA11y: Remove interactivity from UserIcon if onClick is not provided
featureAccessibility: Add aria-pressed state to FilterPill
featureAccessibility: Colorblind-safe line style fill patterns
featureAlerting: Add Mimir Alertmanager auto-sync configuration to settings page
featureAlerting: Add alerting.rulesAPIV2 feature flag
featureAlerting: Add common section to filter dropdown in Alerts Activity
featureAlerting: Add feature flag for notifications api migration
featureAlerting: Add label section to enrichment view/edit drawers (Enterprise)
featureAlerting: Add reusable hook to add enrichment query param to url on drawer open
featureAlerting: Add support for label selectors in AlertRule and RecordingRule legacy storage
featureAlerting: Alert activity UI improvements part 3
featureAlerting: Alert activity groupBy not filtering by environment
featureAlerting: Alerts Activity Instance drawer drilldown, Silence flow
featureAlerting: Allow restricting contact point integration types
featureAlerting: Block Viewers from Alert Group edit route
featureAlerting: Block editing plugin-provided and provisioned rule groups
featureAlerting: Deduplicate and validate groupBy labels in alerts
featureAlerting: Export external Alertmanager sender metrics with data source UIDs
featureAlerting: Include error in Loki state history when exec_err_state is Alerting
featureAlerting: Mark notification provisioning endpoints deprecated
featureAlerting: Move filters to sidebar alerts activity
featureAlerting: Open new alert rule drawer from panel menu
featureAlerting: Preview notification routing in the alert instances table
featureAlerting: Propagate plugin rule origin as X-Rule-Origin header
featureAlerting: Remove alertRuleUseFiredAtForStartsAt feature toggle
featureAlerting: Restrict email contact point recipients to org members
featureAlerting: Set enrichment uid in url for enrichment view/edit drawer (Enterprise)
featureAlerting: Small improvements to instance drawer drilldown silence flow
featureAlerting: Support creating Grafana-managed rules without a group
featureAlerting: Surface contact point save errors in the UI
featureAlerting: Surface errors on contact point creation
featureAlerting: Surface save and bulk-delete errors to the user
featureAlerting: Use Rules API v2 in panel alert rule drawer
featureAnnotations: Clustering GA
featureAuth: Support inline public keys for JWT authentication
featureAuth: Use GrafanaComProxyAPIToken for managed plugin API requests (Enterprise)
featureAuth: Use dedicated token for requests to Grafana.com
breakingPrometheus: Remove azure and sigv4 auth from core prometheus
breakingPrometheus: Remove grafana-prometheus package#122953
+171 more items in the release notessecuritySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
featureProvisioning: Default save from a branch preview to the previewed branch
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported
securityCVE-2026-92539: IAM: Fix: Scim endpoints (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-81842
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
securitySecurity: Fix CVE-2026-19475
fixDashboards: Fix version dates and user display names in the legacy version history page
securityCVE-2026-17183
fixReporting: batch dashboard lookups when listing reports (Enterprise)
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureGo: Update version to 1.26.5
featureProvisioning: Improve form errors for github connections
fixDashboard: Fixes issue with interval variable with Auto value
fixProvisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422)
fixalerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL
featureDocker: Bump Alpine-based images to 3.24.1
featureProvisioning: Write _folder.json when creating dashboards in new folders
featureProvisioning: Write _folder.json when moving dashboards into new folders
fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
fixProvisioning: Fix PR comments on multi-org Grafana instances
fixProvisioning: Fix PR links when folder is renamed via UI
fixfix(provisioning): ignore terminating repositories when validating connection delete
fixfix: bad MySQL query in datasource_type column migration
featureDashboards: Show k8s format in provisioned save
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
featureHomepage: Support v2 dashboards if defined by a file
featureLibraryPanels: Return 403 instead of 500 for insufficient permissions
featureProvisioning: Don't mark folders pending due to _folder.json metadata
featureProvisioning: Honor ruleset bypass for write workflow validation
featureProvisioning: Negotiate receive-pack capabilities for git pushes
featureProvisioning: Per-verb fallback for the files subresource
featureProvisioning: Scope repository uniqueness by (URL, branch, path)
featureProvisioning: Surface folder uid-too-long and other validation 4xx as sync warnings
featureProvisioning: add public_root_url instance setting for external URLs
fixDashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams
fixJaeger: Fix log event timestamp unit conversion in trace view
fixK8s Dashboards: Fix folder permission check to use dashboards:create
fixPostgreSQL: Allow sql_engine to return results for EXPLAIN queries
fixProvisioning: Bump nanogit to v0.17.0 to fix pushes with repositories using git modules
fixRBAC: Quick fix for global datasource permissions (Enterprise)
securitySecurity: CVE-2026-9029
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securitySecurity: CVE-2026-8595
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
featureDashboard: Preserve timezone user-preference when converting V1 → V2
featureProvisioning: Include dashboard validation errors in pull request comments
fixUnified storage: Skip migrations if dualwrite state shows they were already migrated
securitySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported (#128259)
securityCVE-2026-92539: IAM: Fix CVE-2026-92539: Scim endpoints (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-81842
fixUnified Storage: Return 403 instead of 500 on namespace mismatch
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
securitySecurity: Fix CVE-2026-14199
securitySecurity: Fix CVE-2026-19475
fixDashboards: Fix adhoc and groupby variable datasource on UI import
fixDashboards: Fix version dates and user display names in the legacy version history page
securityCVE-2026-17183
featureDashboard Import: Labels in v2 schema
fixAzure Monitor: fix migration for dimension filters
featureDashboards: Get annotations and dashboard endpoint performance improvements
fixDashboardDS: Fix Mixed panels with a time override stuck in permanent loading
featureAlerting: Add protected fields authorization check to provisioning API
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureGo: Update version to 1.26.5
fixJaeger: Handle gzip, deflate, and brotli compressed API responses
fixalerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL
featureDocker: Bump Alpine-based images to 3.24.1
fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
featureBrowse dashboards: Make elements visible and flow better when zoomed
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
featureGraphite: Strip tagged path from tags.name when aliasSub wrapping is detected
featureLibraryPanels: Return 403 instead of 500 for insufficient permissions
featurePlugins: Sanitise header values to printable ASCII for gRPC compatibility
fixAlerting: Fix AlertManagerPicker visibility to check Alertmanager datasources
fixAlerting: Treat not found error when fetching plugins as not installed
fixDashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams
fixJaeger: Fix log event timestamp unit conversion in trace view
fixPostgreSQL: Allow sql_engine to return results for EXPLAIN queries
securitySecurity: CVE-2026-9029
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securitySecurity: CVE-2026-8595
securityFixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
securityFixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.
securityFixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
securityFixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
securityFixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
securityFixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
featureAnalytics: Keep internal dashboard id
featureGo: Update to 1.25.9
featureReporting: Correctly apply appSubURL to report settings requests (Enterprise)
fixAlerting: Document Grafana HA Alertmanager cluster metrics prefix change in Grafana 12.4
featureAnalytics tab: Improve voice over accessibility (Enterprise)
featureDashboards a11y: Do not open time zonemenu on focus
featureDashboards: Resolve display names by identity in version history
featurePlugins: Forward AWS SDK credential chain env vars to external AWS plugins
featurePublic Dashboards: Prevent unintended CRUD operations from different orgs
fixIAM: Handle NULL team_member.external column to fix dashboard loading
fixPlugins: Fix installer IsDisabled condition
fixPlugins: Forward PLUGIN_UNIX_SOCKET_DIR to plugin processes to fix tmp dir in restricted environments
securitySecurity: Fixes CVE-2026-27876
securitySecurity: Fixes CVE-2026-27877
securitySecurity: Fixes CVE-2026-28375
securitySecurity: Fixes CVE-2026-27879
securitySecurity: Fixes CVE-2026-27880
securitySecurity: Fixes CVE-2026-33375
securityFixes CVE-2026-21725: A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.
This requires several very stringent conditions…
featureAccessControl: Invalidate scope resolver cache on datasource deletion
featureGo: Update to 1.25.8
featureRendering: Add support for custom CA certs in Image Renderer
fixAccessControl: Fix test utility for datasource deletion permissions cleanup (Enterprise)
fixAlerting: Change scope for testing new receivers to use supported resource type.
fixAlerting: Fix CollateAlertRuleGroup migration for MariaDB compatibility
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
securityFixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We enco…
securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.
securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
featureAPI: Add missing scope check on dashboards
featureAlerting Enrichment: Add new RBAC permissions for reading and writing enrichments (Enterprise)
featureAlerting: Add Alert Rules tabs navigation with feature toggle
featureAlerting: Add Alert activity card to alerting home page
featureAlerting: Add Cursor frontmatter to CLAUDE.md for auto-loading
featureAlerting: Add Edit/Export actions to group rows, clickable folders, and square icon for recording rules
featureAlerting: Add RBAC for enrichment
featureAlerting: Add RBAC to enrichments (Enterprise)
featureAlerting: Add UI for imported time intervals
featureAlerting: Add alert labels as tags on annotations (#28610)
featureAlerting: Add alertingSyncNotifiersApiMigration feature flag
featureAlerting: Add compressed periodic save for alert instances
featureAlerting: Add counts for firing and pending alert rules
featureAlerting: Add empty state to triage page WIP
featureAlerting: Add expression type information to webhook valueString
featureAlerting: Add feature toggle to disable DMA creation in UI
featureAlerting: Add first CLAUDE.md in the frontend alerting folder
featureAlerting: Add folder_uid label to the grafana_alerting_rule_group_rules metric
featureAlerting: Add gh in CLAUDE.md
featureAlerting: Add limits for the size of expanded notification templates
featureAlerting: Add managed folder validation frontend
featureAlerting: Add policy selector in the alert rule form
featureAlerting: Add saved searches feature for alert rules page
featureAlerting: Add viz wrapper for run queries in enrichment (Enterprise)
featureAlerting: Alerts page performance improvements
featureAlerting: Analyze an alert rule with Grafana Assistant
featureAlerting: Apply pending period to NoData and Error alerts
featureAlerting: Change group filtering to search-based using lightweight BE endpoint
featureAlerting: Collate alert_rule.namespace_uid column as binary
featureAlerting: Collate rule_group column as binary
featureAlerting: Config option to set default datasource in Prometheus rule import
featureAlerting: Correct relative paths in CLAUDE.md Required Reading links
featureAlerting: Dedicated permission for Template testing API
featureAlerting: Deprecate OpsGenie integration
featureAlerting: Filter out imported contact points from simplified routing dropdown
+320 more items in the release notessecurityCVE-2026-17183
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureGo: Update version to 1.26.5
fixalerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL
featureDocker: Bump Alpine-based images to 3.24.1
fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
featureDashboards: Get annotations and dashboard endpoint performance improvements
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
featureLibraryPanels: Return 403 instead of 500 for insufficient permissions
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securityFixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
securityFixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.
securityFixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
securityFixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
securityFixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
securityFixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
securityFixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr…
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
securityFixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re…
securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
featurePublic Dashboards: Prevent unintended CRUD operations from different orgs
securitySecurity: Fixes CVE-2026-27876
securitySecurity: Fixes CVE-2026-27877
securitySecurity: Fixes CVE-2026-28375
securitySecurity: Fixes CVE-2026-27879
securitySecurity: Fixes CVE-2026-27880
featureGo: Update to 1.25.8
featureRendering: Add support for custom CA certs in Image Renderer
fixDashboards: Fix start parameter in list versions API for K8s backend
fixDashboard Export: Fix datasource variable templating in dashboard export
fixProvisioning: Bump nanogit v0.3.1 with missing objects fixes
securityFixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
featureAlerting: Add limits for the size of expanded notification templates
featureCorrelations: Remove support for org_id=0
featureGo: Update to 1.25.7
featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled
featureSecurity(TraceView): Sanitize html
securityFixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack…
featureAPI: Add missing scope check on dashboards
featureAvatar: Require sign-in, remove queue, respect timeout
featureElasticSearch: Update annotation time-range properties
featureExplore: Reset legend when a new query is run
featureGo: Update to 1.25.6
fixAlerting: Fix a race condition panic in ResetStateByRuleUID
fixAlerting: Fix data source recording rules editor
featureAlerting: Update alerting dependency
featureAzure: Improved column handling in logs query builder
featureAzure: Include aggregate columns in logs builder
featureDependencies: Bump Go to v1.25.5
featureDocs: Clarify section title for repeating rows and tabs
featurePlugins: Add PluginContext to plugins when scenes is disabled
featureQueryEditorRows: Clear hideSeriesFrom override on query edit
fixAzure: Fix dcount aggregation
fixAzure: Fix percentile syntax
fixDashboards: Fix empty space under time controls when a dashboard has a lot of variables
fixPlugins: Datasource breadcrumb link should link to settings tab
fixPostgresql: Fix variable interpolation logic when the variable has multiple values
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
securityFixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We enco…
securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.
securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
featureAPI Clients: Add lazy hooks to clients
featureAPI clients: Automatically set PATCH headers
featureAPI clients: Extract into a package
featureAPI clients: Extract into a package (Enterprise)
featureAPI clients: Update API clients to include all endpoints & add hooks
featureAccessControl: Include hidden roles in service account role display
featureAccessControl: Increase limit of LBAC for Datasources rules
featureAccessibility: Wrap data source info onto 2 lines at small viewports
featureAlert Enrichment: Add mutator to insert rule UID labels to allow for efficient use of labelSelector (Enterprise)
featureAlerting: Add enrichment components to rule view page (Enterprise)
featureAlerting: Add enrichment section to rule view page (Enterprise)
featureAlerting: Add jitter support for periodic alert state storage to reduce database load spikes
featureAlerting: Add position-based matching for identical alert rules
featureAlerting: Create alertingAlertRuleFormSchema in restrictedGrafanaApis
featureAlerting: Display error message in central state history view
featureAlerting: Enrichment per rule wip-2 (Enterprise)
featureAlerting: Hide metadata if grouping by folder
featureAlerting: Improve template ai helper prompt and add some examples (Enterprise)
featureAlerting: Move enrichment tab between details and versions
featureAlerting: Remove ai feedback button from alert form
featureAlerting: Remove unused components
featureAlerting: Remove useRulesSourcesWithRuler for SmartAlertTypeDetector
featureAlerting: Surface remote AM silence creation errors properly
featureAlerting: Triage
featureAlerting: Triage rule details drawer
featureAlerting: Update prompt examples for template AI Helper (Enterprise)
featureAlerting: Update width to instance details drawer in Triage page
featureAlerting: Use new enrichment endpoints in FE (Enterprise)
featureAlerting: Use ruleUid as a prop instead of extracting it from the rule context (Enterprise)
featureAnalytics: Aggregate daily summary in datasources analytics (Enterprise)
featureAnalytics: Apply proper batching to Loki exports and add configurable settings (Enterprise)
featureAnnotations: Exclude internal dashboard id when saved via UID
featureAzure: Use SSO settings in plugin context
featureButtons: Active style for buttons
featureCaching: Disable cache if datasource has oauthPassThru=true (Enterprise)
+116 more items in the release notesfeatureDocker: Bump Alpine-based images to 3.24.1
fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securityFixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
securityFixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.
securityFixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
securityFixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
securityFixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
securityFixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
securityFixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr…
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
securityFixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re…
securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
securitySecurity: Fixes CVE-2026-27876
securitySecurity: Fixes CVE-2026-27877
securitySecurity: Fixes CVE-2026-28375
securitySecurity: Fixes CVE-2026-27879
securitySecurity: Fixes CVE-2026-27880
featureGo: Update to 1.25.8
featureRendering: Add support for custom CA certs in Image Renderer
fixDashboards: Fix start parameter in list versions API for K8s backend
fixDashboard Export: Fix datasource variable templating in dashboard export
featureAlerting: Add limits for the size of expanded notification templates
featureCorrelations: Remove support for org_id=0
featureGo: Update to 1.25.7
featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled
featureSecurity(TraceView): Sanitize html
securityFixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack…
securityFixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
featureAPI: Add missing scope check on dashboards
featureAvatar: Require sign-in, remove queue, respect timeout
featureDocs: Clarify section title for repeating rows and tabs
featureElasticSearch: Update annotation time-range properties
featureExplore: Reset legend when a new query is run
featureGo: Update to 1.25.6
fixAlerting: Fix a race condition panic in ResetStateByRuleUID
securityFixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa…
securityFixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops…
featureAlerting: Update alerting dependency
featureAzure: Improved column handling in logs query builder
featureAzure: Include aggregate columns in logs builder
featureDependencies: Bump Go to v1.25.5
featurePlugins: Add PluginContext to plugins when scenes is disabled
featureQueryEditorRows: Clear hideSeriesFrom override on query edit
fixAlerting: Fix contact points issue
fixAzure: Fix dcount aggregation
fixAzure: Fix percentile syntax
fixPostgresql: Fix variable interpolation logic when the variable has multiple values
featureAccess control: Reduce memory usage when fetching user's permissions
featureTable: Pill and JSON Cells should allow formatting
fixAnalyticsSummaries: Fix dashboard rollup not resetting "last X days" metrics to zero (Enterprise)
fixAnalyticsSummaries: Fix dashboard rollup totals resetting incorrectly (Enterprise)
securitySecurity: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise)
securityFixes CVE-2025-41115: SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.…
featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0
featureGo: Update to 1.25.3
fixAuth: Fix render user OAuth passthrough
fixDashboards: Fix missing Ctrl+O keyboard shortcut for crosshair toggle
fixFix: Fix redirection after login when Grafana is served from subpath
fixFlameGraph: Ensure total is only counted once for recursive function calls
fixLDAP Authentication: Fix URL to propagate username context as parameter
fixPlugins: Dependencies do not inherit parent URL for preinstall
fixTable: Backport the Safari 26 fixes to 12.2.1
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
securityFixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We enco…
securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.
securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
featureAlerting: Add feedback buttons for the new AI helpers (Enterprise)
featureAccess: Remove plugin app access in plugin basic role seeder (Enterprise)
featureActions: Infinity authentication
featureAlerting: Add GMA export to the new list page
featureAlerting: Add alerting AI buttons for cloud (Enterprise)
featureAlerting: Add contact point filter to Active Notifications page
featureAlerting: Add enrichment per rule extension component (Enterprise)
featureAlerting: Add extension point link from alert rule to grafana-metricsdrilldown-app
featureAlerting: Add feature toggle and extension point
featureAlerting: Add keepFiringFor and missing_series_evals_to_resolve to file provisioning
featureAlerting: Add observability to enrichment UI (Enterprise)
featureAlerting: Add tooltips in enrichment list for enrichment type (Enterprise)
featureAlerting: Alert enrichment list page (Enterprise)
featureAlerting: Allow filter by rule source in Filter V2
featureAlerting: Auto refresh contact points in the rule form
featureAlerting: Check if TimeInterval is used in ActiveTimings when deleting
featureAlerting: Disable group consistency check for GMA rules
featureAlerting: Display Error Message in Alert History View
featureAlerting: Enrichment Config Form (Enterprise)
featureAlerting: Filter out private labels before writing recording rules
featureAlerting: List V2 - Add a group link to the rule list item
featureAlerting: List V2 - datasource icons for rules
featureAlerting: Load labels in drop-downs without blocking the interaction with the form inputs
featureAlerting: Mark Prometheus to Grafana conversion API as stable
featureAlerting: Move alerting file to an alerting folder
featureAlerting: Support JSON responses in the Prometheus conversion API
featureAlerting: Support extra labels in the Prometheus conversion API
featureAlerting: Support retry with backoff in alert rule evaluation
featureAlerting: Triage alert history with Assistant if available (Enterprise)
featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)
featureAuth: Add setting to disable username based brute force login protection
featureAuth: Support JWT configs tls_client_ca and jwk_set_bearer_token_file
featureAzure: Resource picker improvements (#109458)
featureAzure: Show resource group in picker
featureCanvas: Add option to disable tooltips for one-click elements
+101 more items in the release notes