Security patch with alerting fix
This security release addresses multiple CVEs and fixes an error when updating Alertmanager config with autogenerated receivers. Update is recommended to receive the latest security patches.
Download page
What's new highlights
Bug fixes
- Alerting: Fix error when updating Alertmanager config with autogenerated receivers #113712, @moustafab
- Security: CVE-2026-28374
- Security: CVE-2026-28376
- Security: CVE-2026-28383
- Security: CVE-2026-28380
- Security: CVE-2026-33376
- Security: CVE-2026-28379
- Security: CVE-2026-33377
- Security: CVE-2026-33378
- Security: CVE-2026-33381
- Security: CVE-2026-33380
Source: original entry ↗
More from Grafana
Follow Grafana to get its new changes in your feed and email digest.
Grafana 12.4.13
This release includes multiple security vulnerability fixes (CVE-2026-15577, CVE-2026-33374, CVE-2026-93294, and CVE-2026-92539), an enhancement to strip sensitive headers from OAuth2 cross-host redirects in alerting, and improved dashboard collection deletion handling.
Grafana 13.1.8
This release includes four security fixes addressing CVEs, an improvement to strip sensitive headers from OAuth2 cross-host redirects in alerting, and a fallback enhancement for dashboard collection deletion.
Grafana 13.0.11
Grafana 13.0.11 includes security patches for four CVEs, improvements to alerting with OAuth2 header stripping and dashboard collection deletion fallback, and an IAM SCIM endpoint fix.