Grafana 12.3.11 → 13.3.0
44 releases · 6 breaking changes · 125 security fixes · 6 advisories fixed
125security6breaking0deprecated209feature54fix
Vulnerabilities fixed by this upgrade
- 6.5 CVE-2026-27877 When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco…
- 6.5 CVE-2026-27879 A resample query can be used to trigger out-of-memory crashes in Grafana.
- 7.5 CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
- 6.5 CVE-2026-28375 A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
- 9.1 CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
- 2.6 CVE-2026-21725 A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions…
Breaking changes
- breaking Plugins marketplace: rename config.ini section from marketplace to plugins_marketplace in 13.3.0
- breaking Alerting: Remove alertingSaveStateCompressed feature flag in 13.2.0
- breaking Prometheus: Remove azure and sigv4 auth from core prometheus in 13.1.0
- breaking Prometheus: Remove grafana-prometheus package#122953 in 13.1.0
- breaking Zipkin: Remove from core plugins in 13.1.0
- breaking Plugins: Prevent passing host environment variables to plugin processes by default in 12.4.0
Security changes
- security Security: Fix CVE-2026-100105 in 13.3.0
- security Security: Fix CVE-2026-13719 in 13.3.0
- security Security: Fix CVE-2026-13720 in 13.3.0
- security Security: Fix CVE-2026-15577 in 13.3.0
- security Security: Fix CVE-2026-33374 in 13.3.0
- security Security: Fix CVE-2026-81841 in 13.3.0
- security Security: Fix CVE-2026-88858 in 13.3.0
- security Security: Fix CVE-2026-88967 in 13.3.0
- security Security: Fix CVE-2026-93294 in 13.3.0
- security Security: Fix CVE-2026-95502 in 13.3.0
- security Security: Fix CVE-2026-17183 in 13.3.0
- security Security: Fix CVE-2026-100105 in 13.2.5
- security Security: Fix CVE-2026-103506 in 13.2.5
- security Security: Fix CVE-2026-88858 in 13.2.5
- security Security: Fix CVE-2026-88967 in 13.2.5
- security Security: Fix CVE-2026-15577 in 13.2.4
- security Security: Fix CVE-2026-33374 in 13.2.4
- security Security: Fix CVE-2026-93294 in 13.2.4
- security Security: Fix CVE-2026-95502 in 13.2.4
- security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.2.4
- security Security: Fix CVE-2026-13719 in 13.2.3
- security Security: Fix CVE-2026-13720 in 13.2.3
- security Security: Fix CVE-2026-81841 in 13.2.3
- security Security: Fix CVE-2026-15815 in 13.2.2
- security Security: Fix CVE-2026-76154 in 13.2.2
- security Security: Fix CVE-2026-79656 in 13.2.2
- security Security: Fix CVE-2026-12704 in 13.2.1
- security Security: Fix CVE-2026-14199 in 13.2.1
- security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.2.0
- security CVE-2026-17183 in 13.2.0
- security Security: Fix CVE-2026-100105 in 13.1.9
- security Security: Fix CVE-2026-88858 in 13.1.9
- security Security: Fix CVE-2026-88967 in 13.1.9
- security Security: Fix CVE-2026-15577 in 13.1.8
- security Security: Fix CVE-2026-33374 in 13.1.8
- security Security: Fix CVE-2026-93294 in 13.1.8
- security Security: Fix CVE-2026-95502 in 13.1.8
- security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.1.8
- security Security: Fix CVE-2026-13719 in 13.1.7
- security Security: Fix CVE-2026-13720 in 13.1.7
- security Security: Fix CVE-2026-81841 in 13.1.7
- security Security: Fix CVE-2026-15815 in 13.1.6
- security Security: Fix CVE-2026-76154 in 13.1.6
- security Security: Fix CVE-2026-79656 in 13.1.6
- security Security: Fix CVE-2026-12704 in 13.1.5
- security Security: Fix CVE-2026-14199 in 13.1.5
- security Security: Fix CVE-2026-19475 in 13.1.5
- security CVE-2026-17183 in 13.1.4
- security Security: Fix CVE-2026-13438 in 13.1.2
- security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.1.0
- security Security: Fix CVE-2026-100105 in 13.0.12
- security Security: Fix CVE-2026-88858 in 13.0.12
- security Security: Fix CVE-2026-88967 in 13.0.12
- security Security: Fix CVE-2026-15577 in 13.0.11
- security Security: Fix CVE-2026-33374 in 13.0.11
- security Security: Fix CVE-2026-93294 in 13.0.11
- security Security: Fix CVE-2026-95502 in 13.0.11
- security CVE-2026-92539: IAM: Fix: Scim endpoints (Enterprise) in 13.0.11
- security Security: Fix CVE-2026-13719 in 13.0.10
- security Security: Fix CVE-2026-13720 in 13.0.10
- security Security: Fix CVE-2026-81841 in 13.0.10
- security Security: Fix CVE-2026-81842 in 13.0.10
- security Security: Fix CVE-2026-15815 in 13.0.9
- security Security: Fix CVE-2026-76154 in 13.0.9
- security Security: Fix CVE-2026-79656 in 13.0.9
- security Security: Fix CVE-2026-12704 in 13.0.8
- security Security: Fix CVE-2026-14199 in 13.0.8
- security Security: Fix CVE-2026-19475 in 13.0.8
- security CVE-2026-17183 in 13.0.7
- security Security: CVE-2026-9029 in 13.0.2
- security Security: CVE-2026-33382 in 13.0.2
- security Security: CVE-2026-42127 in 13.0.2
- security Security: CVE-2026-42129 in 13.0.2
- security Security: CVE-2026-10601 in 13.0.2
- security Security: CVE-2026-8609 in 13.0.2
- security Security: CVE-2026-8595 in 13.0.2
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 13.0.1
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 13.0.1
- security Security: Fix CVE-2026-100105 in 12.4.14
- security Security: Fix CVE-2026-88858 in 12.4.14
- security Security: Fix CVE-2026-88967 in 12.4.14
- security Security: Fix CVE-2026-15577 in 12.4.13
- security Security: Fix CVE-2026-33374 in 12.4.13
- security Security: Fix CVE-2026-93294 in 12.4.13
- security CVE-2026-92539: IAM: Fix CVE-2026-92539: Scim endpoints (Enterprise) in 12.4.13
- security Security: Fix CVE-2026-13719 in 12.4.12
- security Security: Fix CVE-2026-13720 in 12.4.12
- security Security: Fix CVE-2026-81841 in 12.4.12
- security Security: Fix CVE-2026-81842 in 12.4.12
- security Security: Fix CVE-2026-12704 in 12.4.11
- security Security: Fix CVE-2026-15815 in 12.4.11
- security Security: Fix CVE-2026-76154 in 12.4.11
- security Security: Fix CVE-2026-79656 in 12.4.11
- security Security: Fix CVE-2026-14199 in 12.4.10
- security Security: Fix CVE-2026-19475 in 12.4.10
- security CVE-2026-17183 in 12.4.9
- security Security: CVE-2026-9029 in 12.4.4
- security Security: CVE-2026-33382 in 12.4.4
- security Security: CVE-2026-42127 in 12.4.4
- security Security: CVE-2026-42129 in 12.4.4
- security Security: CVE-2026-10601 in 12.4.4
- security Security: CVE-2026-8609 in 12.4.4
- security Security: CVE-2026-8595 in 12.4.4
- security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.4.3
- security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.4.3
- security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.4.3
- security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.4.3
- security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.4.3
- security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.4.3
- security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.4.3
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.4.3
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.4.3
- security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.4.3
- security Security: Fixes CVE-2026-27876 in 12.4.2
- security Security: Fixes CVE-2026-27877 in 12.4.2
- security Security: Fixes CVE-2026-28375 in 12.4.2
- security Security: Fixes CVE-2026-27879 in 12.4.2
- security Security: Fixes CVE-2026-27880 in 12.4.2
- security Security: Fixes CVE-2026-33375 in 12.4.2
- security Fixes CVE-2026-21725: A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions… in 12.4.1
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.4.0
- security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.4.0
- security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.4.0
- security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.4.0
- security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.4.0
Every release in between
securitySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAccess control: reject global role creation in single-org mode (Enterprise)
featureAlerting: Add AccessControlAction entries for inhibition rules
featureAlerting: Add notifications API boundary module
featureAlerting: Add the Config API data layer for external Alertmanager auto-sync
featureAlerting: Allow drag and drop for yaml file as import source for import wizard
featureAlerting: Cleanup promote staged config code
featureAlerting: Disable datasource picker while an import is staged
featureAlerting: Make stage default import method in GMA import wizard
featureAlerting: Make the Import wizard review step preview look clickable
featureAlerting: Migrate the Import-to-GMA wizard's auto-sync integration
featureAlerting: Migrate the auto-sync settings hook and panel onto the Config API
featureAlerting: Promote AlertRule, RecordingRule and RuleSequence to v1beta1
featureAlerting: Promote a staged import configuration
featureAlerting: Read staged config origin from the managed_by field
featureAlerting: Redact secrets from the Import-to-GMA preview modal
featureAlerting: Refactor useIsAutoSyncActive onto the shared Config-API helpers
featureAlerting: Remove import method from import to GMA wizard
featureAlerting: Retire the legacy admin_config auto-sync path
featureAlerting: Show Auto-sync support in the import wizard picker
featureAlerting: Support Mimir alertmanager_config files in Import to GMA wizard
featureAlerting: Surface external Alertmanager sync health in the settings UI
featureAlerting: stop auto-sync from force-skipping the Rules step in the GMA import wizard
featureAuth: Bound OAuth token refresh lock waits by time instead of attempts
featureCanvas: Load the standalone plugin by default
featureChore: Upgrade to k8s v0.37.0 (and grafana-app-sdk v0.60.0)
featureDashboard: Adds new a subtitle option for panel descriptions
featureDashboard: Fall back when collection deletion is unsupported
featureDashboards: Add $__namespace global variable
securitySecurity: Fix CVE-2026-17183
breakingPlugins marketplace: rename config.ini section from marketplace to plugins_marketplace
+123 more items in the release notessecuritySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-103506
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
featureGit Sync: Ignore hidden paths in repository scans and diffs
featureProvisioning: Default save from a branch preview to the previewed branch
featureProvisioning: Never replace the repository root folder during incremental sync
fixPlugins: Don't report loaded plugins as not registered when a request times out
fixProvisioning: Fix PR dashboard previews when served from a sub-path
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported
featureGit Sync: Clarify repository links for pure Git
featureProvisioning: Allow resource previews in unsynced folders
featureProvisioning: Reject invalid resource names before API calls
featureProvisioning: Show last checked time in Pull status
featureProvisioning: Skip previews for pull requests from forks
featureProvisioning: Stop PR previews when refs disappear
featureProvisioning: Support legacy paths and diagnose missing source annotations
featureProvisioning: write terminal sync status back to repository on early sync-job failures and Respect Git Sync polling intervals after unchanged refs
securityCVE-2026-92539: IAM: Fix: SCIM (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
fixProvisioning: Fix folder rename UID collision during full sync
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
fixDashboards: Fix adhoc and groupby variable datasource on UI import
fixPackaging: Fix issue with bundled plugins not being moved properly
fixPanelEditor: Fix options pane not resizable beyond the preview's content width
securityFixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…
securityCVE-2026-17183
featureAlerting: Add Import tab in alerting settings page
featureAlerting: Add notification template import to the import-to-GMA wizard
featureAlerting: Add promote and auto sync to ImportToGMAWizard
featureAlerting: Add staged configuration summary in import settings page
featureAlerting: Compute staged config origin server-side
featureAlerting: Migrate notifications API to v1beta1
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (1/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (2/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (3/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (4/4)
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureAlerting: Revert a staged import configuration
featureAlerting: Show unusable time intervals as disabled in the mute timings selector
featureAlerting: Track import method analytics in import to gma
featureAlerting: remove AlertingCentralHistory FT
featureAnalytics: Add public dashboard UID to loki usage insights events (Enterprise)
featureAuditing: Record the user name on user deletion audit logs (Enterprise)
featureAzure Monitor: Cache subscription lookups and collapse double Unmarshal in buildQuery
featureAzure monitor: Azure Metrics Batch API Implementation backend
featureCloudWatch Logs: Add frontend support for querying by data source
featureColorScale: Remove live hoverValue, remove from HeatMap tooltip
featureDashList: Show dashboard description tooltip when it's available
featureDashboard: redirect from dashboard settings tabs to sidebar counterparts
featureDashboards: Allow threshold interpolation
featureDashboards: Deprecate scripted dashboards and disable them by default
featureDashboards: Enable new view panel controls by default
featureDashboards: Increase nesting depth to 4 and allow nested tabs
featureDashboards: Show panel query errors and notices in one UI
featureDeveloper Guide: Add note about requiring signed commits
featureDocs: document the tracing file exporter
featureExplore Logs: log line highlight color lighten in dark, update deprecated pinned color
featureFolder API: Replace legacy access control logic with app platform API call
featureGo: Update version to 1.26.5
featureGrafanaUI: Add real magnification effect to GrotNotFound lens
featureHome: Enable unified homepage for all users (remove flag)
featureLive: Support redis:// and rediss:// (TLS) connection URLs in ha_engine_address
featureLogs: Add more suggested fields and integrate with the new Logs Table
featureLogs: use gray (dimgray) for debug level color
+122 more items in the release notessecuritySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
featureProvisioning: Default save from a branch preview to the previewed branch
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported
securityCVE-2026-92539: IAM: Fix: SCIM (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
fixProvisioning: Fix folder rename UID collision during full sync
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
securitySecurity: Fix CVE-2026-19475
securityCVE-2026-17183
fixReporting: batch dashboard lookups when listing reports (Enterprise)
fixLogs Table: Fix missing results when logs stream
fixLogs Table: Fix mixed usage of field name and display name
securitySecurity: Fix CVE-2026-13438
featureGo: Update version to 1.26.5
featureProvisioning: Improve form errors for github connections
featureProvisioning: make sync per-resource write timeout configurable
fixAccessibility: Ensure InlineToast contents are announced by screenreaders
fixDashboardDS: Fix chained dashboard datasource panels showing stale data
fixProvisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422)
fixPagination: Set aria-current on active page
securityFixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…
featureA11y: Remove interactivity from UserIcon if onClick is not provided
featureAccessibility: Add aria-pressed state to FilterPill
featureAccessibility: Colorblind-safe line style fill patterns
featureAlerting: Add Mimir Alertmanager auto-sync configuration to settings page
featureAlerting: Add alerting.rulesAPIV2 feature flag
featureAlerting: Add common section to filter dropdown in Alerts Activity
featureAlerting: Add feature flag for notifications api migration
featureAlerting: Add label section to enrichment view/edit drawers (Enterprise)
featureAlerting: Add reusable hook to add enrichment query param to url on drawer open
featureAlerting: Add support for label selectors in AlertRule and RecordingRule legacy storage
featureAlerting: Alert activity UI improvements part 3
featureAlerting: Alert activity groupBy not filtering by environment
featureAlerting: Alerts Activity Instance drawer drilldown, Silence flow
featureAlerting: Allow restricting contact point integration types
featureAlerting: Block Viewers from Alert Group edit route
featureAlerting: Block editing plugin-provided and provisioned rule groups
featureAlerting: Deduplicate and validate groupBy labels in alerts
featureAlerting: Export external Alertmanager sender metrics with data source UIDs
featureAlerting: Include error in Loki state history when exec_err_state is Alerting
featureAlerting: Mark notification provisioning endpoints deprecated
featureAlerting: Move filters to sidebar alerts activity
featureAlerting: Open new alert rule drawer from panel menu
featureAlerting: Preview notification routing in the alert instances table
featureAlerting: Propagate plugin rule origin as X-Rule-Origin header
featureAlerting: Remove alertRuleUseFiredAtForStartsAt feature toggle
featureAlerting: Restrict email contact point recipients to org members
featureAlerting: Set enrichment uid in url for enrichment view/edit drawer (Enterprise)
featureAlerting: Small improvements to instance drawer drilldown silence flow
featureAlerting: Support creating Grafana-managed rules without a group
featureAlerting: Surface contact point save errors in the UI
featureAlerting: Surface errors on contact point creation
featureAlerting: Surface save and bulk-delete errors to the user
featureAlerting: Use Rules API v2 in panel alert rule drawer
featureAnnotations: Clustering GA
featureAuth: Support inline public keys for JWT authentication
featureAuth: Use GrafanaComProxyAPIToken for managed plugin API requests (Enterprise)
featureAuth: Use dedicated token for requests to Grafana.com
breakingPrometheus: Remove azure and sigv4 auth from core prometheus
breakingPrometheus: Remove grafana-prometheus package#122953
+171 more items in the release notessecuritySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
featureProvisioning: Default save from a branch preview to the previewed branch
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported
securityCVE-2026-92539: IAM: Fix: Scim endpoints (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-81842
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
securitySecurity: Fix CVE-2026-19475
fixDashboards: Fix version dates and user display names in the legacy version history page
securityCVE-2026-17183
fixReporting: batch dashboard lookups when listing reports (Enterprise)
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureGo: Update version to 1.26.5
featureProvisioning: Improve form errors for github connections
fixDashboard: Fixes issue with interval variable with Auto value
fixProvisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422)
fixalerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL
featureDocker: Bump Alpine-based images to 3.24.1
featureProvisioning: Write _folder.json when creating dashboards in new folders
featureProvisioning: Write _folder.json when moving dashboards into new folders
fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
fixProvisioning: Fix PR comments on multi-org Grafana instances
fixProvisioning: Fix PR links when folder is renamed via UI
fixfix(provisioning): ignore terminating repositories when validating connection delete
fixfix: bad MySQL query in datasource_type column migration
featureDashboards: Show k8s format in provisioned save
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
featureHomepage: Support v2 dashboards if defined by a file
featureLibraryPanels: Return 403 instead of 500 for insufficient permissions
featureProvisioning: Don't mark folders pending due to _folder.json metadata
featureProvisioning: Honor ruleset bypass for write workflow validation
featureProvisioning: Negotiate receive-pack capabilities for git pushes
featureProvisioning: Per-verb fallback for the files subresource
featureProvisioning: Scope repository uniqueness by (URL, branch, path)
featureProvisioning: Surface folder uid-too-long and other validation 4xx as sync warnings
featureProvisioning: add public_root_url instance setting for external URLs
fixDashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams
fixJaeger: Fix log event timestamp unit conversion in trace view
fixK8s Dashboards: Fix folder permission check to use dashboards:create
fixPostgreSQL: Allow sql_engine to return results for EXPLAIN queries
fixProvisioning: Bump nanogit to v0.17.0 to fix pushes with repositories using git modules
fixRBAC: Quick fix for global datasource permissions (Enterprise)
securitySecurity: CVE-2026-9029
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securitySecurity: CVE-2026-8595
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
featureDashboard: Preserve timezone user-preference when converting V1 → V2
featureProvisioning: Include dashboard validation errors in pull request comments
fixUnified storage: Skip migrations if dualwrite state shows they were already migrated
securitySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported (#128259)
securityCVE-2026-92539: IAM: Fix CVE-2026-92539: Scim endpoints (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-81842
fixUnified Storage: Return 403 instead of 500 on namespace mismatch
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
securitySecurity: Fix CVE-2026-14199
securitySecurity: Fix CVE-2026-19475
fixDashboards: Fix adhoc and groupby variable datasource on UI import
fixDashboards: Fix version dates and user display names in the legacy version history page
securityCVE-2026-17183
featureDashboard Import: Labels in v2 schema
fixAzure Monitor: fix migration for dimension filters
featureDashboards: Get annotations and dashboard endpoint performance improvements
fixDashboardDS: Fix Mixed panels with a time override stuck in permanent loading
featureAlerting: Add protected fields authorization check to provisioning API
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureGo: Update version to 1.26.5
fixJaeger: Handle gzip, deflate, and brotli compressed API responses
fixalerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL
featureDocker: Bump Alpine-based images to 3.24.1
fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
featureBrowse dashboards: Make elements visible and flow better when zoomed
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
featureGraphite: Strip tagged path from tags.name when aliasSub wrapping is detected
featureLibraryPanels: Return 403 instead of 500 for insufficient permissions
featurePlugins: Sanitise header values to printable ASCII for gRPC compatibility
fixAlerting: Fix AlertManagerPicker visibility to check Alertmanager datasources
fixAlerting: Treat not found error when fetching plugins as not installed
fixDashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams
fixJaeger: Fix log event timestamp unit conversion in trace view
fixPostgreSQL: Allow sql_engine to return results for EXPLAIN queries
securitySecurity: CVE-2026-9029
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securitySecurity: CVE-2026-8595
securityFixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
securityFixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.
securityFixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
securityFixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
securityFixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
securityFixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
featureAnalytics: Keep internal dashboard id
featureGo: Update to 1.25.9
featureReporting: Correctly apply appSubURL to report settings requests (Enterprise)
fixAlerting: Document Grafana HA Alertmanager cluster metrics prefix change in Grafana 12.4
featureAnalytics tab: Improve voice over accessibility (Enterprise)
featureDashboards a11y: Do not open time zonemenu on focus
featureDashboards: Resolve display names by identity in version history
featurePlugins: Forward AWS SDK credential chain env vars to external AWS plugins
featurePublic Dashboards: Prevent unintended CRUD operations from different orgs
fixIAM: Handle NULL team_member.external column to fix dashboard loading
fixPlugins: Fix installer IsDisabled condition
fixPlugins: Forward PLUGIN_UNIX_SOCKET_DIR to plugin processes to fix tmp dir in restricted environments
securitySecurity: Fixes CVE-2026-27876
securitySecurity: Fixes CVE-2026-27877
securitySecurity: Fixes CVE-2026-28375
securitySecurity: Fixes CVE-2026-27879
securitySecurity: Fixes CVE-2026-27880
securitySecurity: Fixes CVE-2026-33375
securityFixes CVE-2026-21725: A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.
This requires several very stringent conditions…
featureAccessControl: Invalidate scope resolver cache on datasource deletion
featureGo: Update to 1.25.8
featureRendering: Add support for custom CA certs in Image Renderer
fixAccessControl: Fix test utility for datasource deletion permissions cleanup (Enterprise)
fixAlerting: Change scope for testing new receivers to use supported resource type.
fixAlerting: Fix CollateAlertRuleGroup migration for MariaDB compatibility
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
securityFixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We enco…
securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.
securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
featureAPI: Add missing scope check on dashboards
featureAlerting Enrichment: Add new RBAC permissions for reading and writing enrichments (Enterprise)
featureAlerting: Add Alert Rules tabs navigation with feature toggle
featureAlerting: Add Alert activity card to alerting home page
featureAlerting: Add Cursor frontmatter to CLAUDE.md for auto-loading
featureAlerting: Add Edit/Export actions to group rows, clickable folders, and square icon for recording rules
featureAlerting: Add RBAC for enrichment
featureAlerting: Add RBAC to enrichments (Enterprise)
featureAlerting: Add UI for imported time intervals
featureAlerting: Add alert labels as tags on annotations (#28610)
featureAlerting: Add alertingSyncNotifiersApiMigration feature flag
featureAlerting: Add compressed periodic save for alert instances
featureAlerting: Add counts for firing and pending alert rules
featureAlerting: Add empty state to triage page WIP
featureAlerting: Add expression type information to webhook valueString
featureAlerting: Add feature toggle to disable DMA creation in UI
featureAlerting: Add first CLAUDE.md in the frontend alerting folder
featureAlerting: Add folder_uid label to the grafana_alerting_rule_group_rules metric
featureAlerting: Add gh in CLAUDE.md
featureAlerting: Add limits for the size of expanded notification templates
featureAlerting: Add managed folder validation frontend
featureAlerting: Add policy selector in the alert rule form
featureAlerting: Add saved searches feature for alert rules page
featureAlerting: Add viz wrapper for run queries in enrichment (Enterprise)
featureAlerting: Alerts page performance improvements
featureAlerting: Analyze an alert rule with Grafana Assistant
featureAlerting: Apply pending period to NoData and Error alerts
featureAlerting: Change group filtering to search-based using lightweight BE endpoint
featureAlerting: Collate alert_rule.namespace_uid column as binary
featureAlerting: Collate rule_group column as binary
featureAlerting: Config option to set default datasource in Prometheus rule import
featureAlerting: Correct relative paths in CLAUDE.md Required Reading links
featureAlerting: Dedicated permission for Template testing API
featureAlerting: Deprecate OpsGenie integration
featureAlerting: Filter out imported contact points from simplified routing dropdown
+320 more items in the release notes