Security · Grafana

Grafana lists ten CVEs in 13.3.0 and fixes an eleventh

Grafana shipped 12.4.14, 13.2.5 and 13.3.0 on 27 October with security lists that do not match: ten CVEs in 13.3.0's security section plus an eleventh fixed in its changelog, four in 13.2.5, three in 12.4.14. The collected records score 4.3 to 6.5, all Medium, and none is Critical.

By BoneTuesday 27 October 20263 min readSecurity

entryread only

filedTuesday 27 October 2026

length3 min

sectionSecurity

subjectGrafana

sourceson the page

Grafana shipped three stable releases on 27 October: 12.4.14, 13.2.5 and 13.3.0. Take the patch for your own branch, but read the lists before assuming they match, because they differ in ways that matter to a reader on the older line.

The lists are not the same

The 13.3.0 security section lists ten identifiers: CVE-2026-100105, -13719, -13720, -15577, -33374, -81841, -88858, -88967, -93294 and -95502.

The 13.2.5 release lists four: CVE-2026-100105, -103506, -88858 and -88967. Note the second, which appears in neither the 13.3.0 nor the 12.4.14 list.

The 12.4.14 release lists three: CVE-2026-100105, -88858 and -88967.

The 13.3.0 changelog also carries a “Fix CVE-2026-17183” entry outside the security section, with pull request #131061, an eleventh fix in the same release, named here without description because no record for it was collected.

What the records actually describe

Seven identifiers have NVD records, published between 29 September and 13 October, and all seven are still “Awaiting Analysis”, so the scores are those records’ CVSS v3.1 metrics, not NVD’s analysis.

CVE-2026-15577, 6.5: “A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection’s configuration through its status subresource.” The record adds that on 12.4 the affected API exists only behind the experimental provisioning toggle.

CVE-2026-33374, 6.5: the Prometheus rule conversion endpoints “do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.”

CVE-2026-93294, 6.3: a user with query access to an Azure Monitor data source “can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs”, with that data source’s Azure identity. The record says the impact is bounded by the role that identity holds.

CVE-2026-13720, 5.4: an Editor can set file-provisioning metadata annotations when creating a dashboard, because those fields “were stored without an authorization check”. The dashboard then looks file-provisioned, and “administrators can no longer update or delete it through Grafana”.

CVE-2026-81841, 5.3: “Pausing a shared (public) dashboard did not revoke its access token” for the endpoints serving frontend bootstrap data. The consequence is worse than the score: anyone with the link to a paused dashboard could still retrieve “the configuration of the dashboard’s data sources, including stored credentials for data sources using browser access”. Deleting the dashboard does revoke the token.

CVE-2026-95502, 5.3: a Git server configured for Git Sync “can exhaust Grafana’s memory by returning oversized or highly compressed responses”. Exploitation needs an administrator to have pointed Git Sync at that server.

CVE-2026-13719, 4.3: an authenticated user can list alert rules “stored in folders they are not allowed to read” through the alert rules API. “When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned.” From 13.1.0, the record says, any user can trigger it with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

Severity, and what is not known

Scores run from 4.3 to 6.5, all Medium, none Critical. Grafana’s advisories page did not render CVE text to the desk’s fetch, so no vendor severity is reported here; these are the records’ CVSS v3.1 metrics, unanalysed by NVD.

Three identifiers have no record in the collected sources: CVE-2026-100105, -88858 and -88967. They appear in every list and are named as identifiers only. CVE-2026-103506 was not queried, so it gets the same treatment. Nothing here characterises them, and no exploit detail is offered for any CVE.

What to take

Match the branch: 12.4.x to 12.4.14, 13.2.x to 13.2.5. There is no 13.3.x patch because 13.3.0 is the new minor, and it carries features as well as fixes, a different subject.

If you use Git Sync or provisioning, the two Git-side fixes and the provisioning-metadata fix come first. If you publish dashboards publicly, the paused-token fix deserves a read. If you use Azure Monitor data sources, check what role the data source identity holds before deciding how much the proxy issue matters.

This is scheduled patching, not an emergency. The desk’s 20 September piece covered the 15 September releases and a different set of vulnerabilities, including a plugin-archive path traversal; this is the October batch.

Sources: the Grafana release records for v13.3.0, v13.2.5 and v12.4.14, plus the NVD records for CVE-2026-13719, -13720, -15577, -33374, -81841, -93294 and -95502.

SecurityPyPI's new Security tab says where a release came from, and that is not a verdictPyPI's redesigned project pages went live on 6 November with a Security tab that reports a release's provenance: full, none, incomplete, inconsistent, changed or lost. The post is explicit that no provenance does not mean malicious, that it means the file origin cannot be cryptographically verified, and that the states worth checking before you install are the warnings.

SecurityPwnEscape Part 2: from a Firecracker guest to root on the host, in a setup without the jailerThe researchers behind October's kernel bug have published the other half: using that host-memory primitive to find Firecracker in memory, take over a live vCPU thread and redirect its return from KVM to a call of their choosing, with the VM left running and reachable. Their test used Firecracker v1.16.1 with the VMM launched as root and no jailer, and they say a jailer-hardened deployment needs a separate assessment. No new CVE, no vendor advisory and no Firecracker fix appears in the source.