Grafana 13.2.4
This release includes four critical security fixes for CVE-2026-15577, CVE-2026-33374, CVE-2026-93294, and CVE-2026-95502. It also adds enhancements to alerting, dashboard collection deletion, Git Sync, provisioning workflows, and IAM SCIM functionality.
Download page
What's new highlights
Security
- Security: Fix CVE-2026-15577
- Security: Fix CVE-2026-33374
- Security: Fix CVE-2026-93294
- Security: Fix CVE-2026-95502
Features and enhancements
- Alerting: Strip sensitive headers from oauth2 cross-host redirects #134433, @JacobsonMT
- Dashboard: Fall back when collection deletion is unsupported #134224, @bestend
- Git Sync: Clarify repository links for pure Git #134253, @ferruvich
- Provisioning: Allow resource previews in unsynced folders #134391, @grafana-writer[bot]
- Provisioning: Reject invalid resource names before API calls #133776, @grafana-writer[bot]
- Provisioning: Show last checked time in Pull status #134483, @ferruvich
- Provisioning: Skip previews for pull requests from forks #133799, @ferruvich
- Provisioning: Stop PR previews when refs disappear #133855, @ferruvich
- Provisioning: Support legacy paths and diagnose missing source annotations #133779, @grafana-writer[bot]
- Provisioning: write terminal sync status back to repository on early sync-job failures and Respect Git Sync polling intervals after unchanged refs #134478, @mustafasencer
Bug fixes
- CVE-2026-92539: IAM: Fix: SCIM (Enterprise)
Source: original entry ↗
More from Grafana
Follow Grafana to get its new changes in your feed and email digest.
Grafana 12.4.13
This release includes multiple security vulnerability fixes (CVE-2026-15577, CVE-2026-33374, CVE-2026-93294, and CVE-2026-92539), an enhancement to strip sensitive headers from OAuth2 cross-host redirects in alerting, and improved dashboard collection deletion handling.
Grafana 13.1.8
This release includes four security fixes addressing CVEs, an improvement to strip sensitive headers from OAuth2 cross-host redirects in alerting, and a fallback enhancement for dashboard collection deletion.
Grafana 13.0.11
Grafana 13.0.11 includes security patches for four CVEs, improvements to alerting with OAuth2 header stripping and dashboard collection deletion fallback, and an IAM SCIM endpoint fix.