Grafana 13.1.3 → 13.2.4

10 releases · 1 breaking change · 30 security fixes · 0 advisories fixed

30security1breaking0deprecated50feature8fix

Is 13.1.3 affected?

Breaking changes

breaking Alerting: Remove alertingSaveStateCompressed feature flag in 13.2.0

Security changes

security Security: Fix CVE-2026-15577 in 13.2.4
security Security: Fix CVE-2026-33374 in 13.2.4
security Security: Fix CVE-2026-93294 in 13.2.4
security Security: Fix CVE-2026-95502 in 13.2.4
security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.2.4
security Security: Fix CVE-2026-13719 in 13.2.3
security Security: Fix CVE-2026-13720 in 13.2.3
security Security: Fix CVE-2026-81841 in 13.2.3
security Security: Fix CVE-2026-15815 in 13.2.2
security Security: Fix CVE-2026-76154 in 13.2.2
security Security: Fix CVE-2026-79656 in 13.2.2
security Security: Fix CVE-2026-12704 in 13.2.1
security Security: Fix CVE-2026-14199 in 13.2.1
security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.2.0
security CVE-2026-17183 in 13.2.0
security Security: Fix CVE-2026-15577 in 13.1.8
security Security: Fix CVE-2026-33374 in 13.1.8
security Security: Fix CVE-2026-93294 in 13.1.8
security Security: Fix CVE-2026-95502 in 13.1.8
security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.1.8
security Security: Fix CVE-2026-13719 in 13.1.7
security Security: Fix CVE-2026-13720 in 13.1.7
security Security: Fix CVE-2026-81841 in 13.1.7
security Security: Fix CVE-2026-15815 in 13.1.6
security Security: Fix CVE-2026-76154 in 13.1.6
security Security: Fix CVE-2026-79656 in 13.1.6
security Security: Fix CVE-2026-12704 in 13.1.5
security Security: Fix CVE-2026-14199 in 13.1.5
security Security: Fix CVE-2026-19475 in 13.1.5
security CVE-2026-17183 in 13.1.4

Every release in between

13.2.4 Oct 13, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-15577

securitySecurity: Fix CVE-2026-33374

securitySecurity: Fix CVE-2026-93294

securitySecurity: Fix CVE-2026-95502

featureAlerting: Strip sensitive headers from oauth2 cross-host redirects

featureDashboard: Fall back when collection deletion is unsupported

featureGit Sync: Clarify repository links for pure Git

featureProvisioning: Allow resource previews in unsynced folders

featureProvisioning: Reject invalid resource names before API calls

featureProvisioning: Show last checked time in Pull status

featureProvisioning: Skip previews for pull requests from forks

featureProvisioning: Stop PR previews when refs disappear

featureProvisioning: Support legacy paths and diagnose missing source annotations

featureProvisioning: write terminal sync status back to repository on early sync-job failures and Respect Git Sync polling intervals after unchanged refs

securityCVE-2026-92539: IAM: Fix: SCIM (Enterprise)

13.2.3 Sep 29, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-13719

securitySecurity: Fix CVE-2026-13720

securitySecurity: Fix CVE-2026-81841

13.2.2 Sep 15, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-15815

securitySecurity: Fix CVE-2026-76154

securitySecurity: Fix CVE-2026-79656

fixDashboards: Preserve query variable refresh setting on v2 dashboard import

fixProvisioning: Fix folder rename UID collision during full sync

13.2.1 Sep 2, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-12704

securitySecurity: Fix CVE-2026-14199

fixDashboards: Fix adhoc and groupby variable datasource on UI import

fixPackaging: Fix issue with bundled plugins not being moved properly

fixPanelEditor: Fix options pane not resizable beyond the preview's content width

13.2.0 Aug 18, 2026 Release notes ↗

securityFixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…

securityCVE-2026-17183

featureAlerting: Add Import tab in alerting settings page

featureAlerting: Add notification template import to the import-to-GMA wizard

featureAlerting: Add promote and auto sync to ImportToGMAWizard

featureAlerting: Add staged configuration summary in import settings page

featureAlerting: Compute staged config origin server-side

featureAlerting: Migrate notifications API to v1beta1

featureAlerting: Recognize "default" and "user-defined" as the default routing tree (1/4)

featureAlerting: Recognize "default" and "user-defined" as the default routing tree (2/4)

featureAlerting: Recognize "default" and "user-defined" as the default routing tree (3/4)

featureAlerting: Recognize "default" and "user-defined" as the default routing tree (4/4)

featureAlerting: Return 403 instead of 500 on contact point provenance mismatch

featureAlerting: Revert a staged import configuration

featureAlerting: Show unusable time intervals as disabled in the mute timings selector

featureAlerting: Track import method analytics in import to gma

featureAlerting: remove AlertingCentralHistory FT

featureAnalytics: Add public dashboard UID to loki usage insights events (Enterprise)

featureAuditing: Record the user name on user deletion audit logs (Enterprise)

featureAzure Monitor: Cache subscription lookups and collapse double Unmarshal in buildQuery

featureAzure monitor: Azure Metrics Batch API Implementation backend

featureCloudWatch Logs: Add frontend support for querying by data source

featureColorScale: Remove live hoverValue, remove from HeatMap tooltip

featureDashList: Show dashboard description tooltip when it's available

featureDashboard: redirect from dashboard settings tabs to sidebar counterparts

featureDashboards: Allow threshold interpolation

featureDashboards: Deprecate scripted dashboards and disable them by default

featureDashboards: Enable new view panel controls by default

featureDashboards: Increase nesting depth to 4 and allow nested tabs

featureDashboards: Show panel query errors and notices in one UI

featureDeveloper Guide: Add note about requiring signed commits

featureDocs: document the tracing file exporter

featureExplore Logs: log line highlight color lighten in dark, update deprecated pinned color

featureFolder API: Replace legacy access control logic with app platform API call

featureGo: Update version to 1.26.5

featureGrafanaUI: Add real magnification effect to GrotNotFound lens

featureHome: Enable unified homepage for all users (remove flag)

featureLive: Support redis:// and rediss:// (TLS) connection URLs in ha_engine_address

featureLogs: Add more suggested fields and integrate with the new Logs Table

featureLogs: use gray (dimgray) for debug level color

+122 more items in the release notes

13.1.8 Oct 13, 2026 Release notes ↗