Is Grafana 12.4.14 affected?

CVSS 7.1

2 known vulnerabilities affect 12.4.14 (highest CVSS 7.1).

12.4.14 is the latest release of its track.

A newer release line is out: 13.3.0.

Vulnerabilities affecting 12.4.14

7.1
CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… fixed in 13.0.0
4.3
CVE-2022-21673 Forward OAuth Identity Token can allow users to access some data sources