This release includes 7 security fixes for security teams reviewing exposed deployments.
Topics
+7 more
ReleasePort's take
Moderate signalGrafana v13.0.2 patches six critical CVEs (CVE-2026‑9029, CVE-2026‑33382, CVE-2026‑42127, CVE-2026‑42129, CVE-2026‑10601, CVE-2026‑8609).
Why it matters: All deployments of Grafana server must patch immediately to mitigate high-severity vulnerabilities (severity 95) across multiple CVEs.
Summary
AI summaryBroad release touches Bug fixes, Features and enhancements, https://github.com/MissingRoberto, and https://github.com/stephaniehingtgen.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Patches security vulnerabilities CVE-2026-9029, CVE-2026-33382, CVE-2026-42127, CVE-2026-42129, CVE-2026-10601, and CVE-2026-8609. Patches security vulnerabilities CVE-2026-9029, CVE-2026-33382, CVE-2026-42127, CVE-2026-42129, CVE-2026-10601, and CVE-2026-8609. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Low |
Shows Kubernetes format in provisioned dashboard saves. Shows Kubernetes format in provisioned dashboard saves. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Low |
Supports v2 dashboards when defined by a file on the homepage. Supports v2 dashboards when defined by a file on the homepage. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Low |
Returns HTTP 403 instead of 500 for insufficient permissions in LibraryPanels. Returns HTTP 403 instead of 500 for insufficient permissions in LibraryPanels. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Low |
Does not mark folders pending due to _folder.json metadata during provisioning. Does not mark folders pending due to _folder.json metadata during provisioning. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Feature | Low |
Honors ruleset bypass for write workflow validation in provisioning. Honors ruleset bypass for write workflow validation in provisioning. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Feature | Low |
Negotiates receive-pack capabilities for git pushes in provisioning. Negotiates receive-pack capabilities for git pushes in provisioning. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Feature | Low |
Implements per‑verb fallback for the files subresource in provisioning. Implements per‑verb fallback for the files subresource in provisioning. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Feature | Low |
Scopes repository uniqueness by (URL, branch, path) in provisioning. Scopes repository uniqueness by (URL, branch, path) in provisioning. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Feature | Low |
Surfaces folder uid‑too‑long and other validation 4xx errors as sync warnings in provisioning. Surfaces folder uid‑too‑long and other validation 4xx errors as sync warnings in provisioning. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Feature | Low |
Adds public_root_url instance setting for external URLs in provisioning. Adds public_root_url instance setting for external URLs in provisioning. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Dependency | Medium |
Bumps Alpine‑based Docker images to version 3.23.4. Bumps Alpine‑based Docker images to version 3.23.4. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Dependency | Medium |
Updates Go runtime to version 1.26.3. Updates Go runtime to version 1.26.3. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Medium |
Fixes Mixed panels not updating on time‑range change with stale upstreams. Fixes Mixed panels not updating on time‑range change with stale upstreams. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Medium |
Corrects log event timestamp unit conversion in Jaeger trace view. Corrects log event timestamp unit conversion in Jaeger trace view. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Medium |
Allows PostgreSQL data source to return results for EXPLAIN queries. Allows PostgreSQL data source to return results for EXPLAIN queries. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Medium |
Bumps nanogit to v0.17.0 to fix pushes with repositories using git modules. Bumps nanogit to v0.17.0 to fix pushes with repositories using git modules. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Low |
Fixes folder permission check to use dashboards:create in K8s Dashboards. Fixes folder permission check to use dashboards:create in K8s Dashboards. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
Full changelog
Download page
What's new highlights
Features and enhancements
- Dashboards: Show k8s format in provisioned save #123045, @stephaniehingtgen
- Docker: Bump Alpine-based images to 3.23.4 #122938, @Proximyst
- Go: Update version to 1.26.3 #124454, @macabu
- Homepage: Support v2 dashboards if defined by a file #123029, @stephaniehingtgen
- LibraryPanels: Return 403 instead of 500 for insufficient permissions #123467, @MissingRoberto
- Provisioning: Don't mark folders pending due to _folder.json metadata #124139, @MissingRoberto
- Provisioning: Honor ruleset bypass for write workflow validation #124128, @MissingRoberto
- Provisioning: Negotiate receive-pack capabilities for git pushes #124130, @MissingRoberto
- Provisioning: Per-verb fallback for the files subresource #123900, @MissingRoberto
- Provisioning: Scope repository uniqueness by (URL, branch, path) #124121, @ferruvich
- Provisioning: Surface folder uid-too-long and other validation 4xx as sync warnings #123888, @MissingRoberto
- Provisioning: add public_root_url instance setting for external URLs #124258, @MissingRoberto
Bug fixes
- DashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams #124894, @ivanortegaalba
- Jaeger: Fix log event timestamp unit conversion in trace view #123707, @ktw4071
- K8s Dashboards: Fix folder permission check to use dashboards:create #124942, @mihai-turdean
- PostgreSQL: Allow sql_engine to return results for EXPLAIN queries #123246, @sdague
- Provisioning: Bump nanogit to v0.17.0 to fix pushes with repositories using git modules #124140, @MissingRoberto
- RBAC: Quick fix for global datasource permissions (Enterprise)
- Security: CVE-2026-9029
- Security: CVE-2026-33382
- Security: CVE-2026-42127
- Security: CVE-2026-42129
- Security: CVE-2026-10601
- Security: CVE-2026-8609
- Security: CVE-2026-8595
Security Fixes
- CVE-2026-9029
- CVE-2026-33382
- CVE-2026-42127
- CVE-2026-42129
- CVE-2026-10601
- CVE-2026-8609
- CVE-2026-8595
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About grafana
The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.
Beta — feedback welcome: [email protected]