If you self-host Grafana OSS or Enterprise on the 12.4, 13.0, 13.1 or 13.2 branch, update. Grafana shipped one security release per branch on 15 September: 12.4.11, 13.0.9, 13.1.6 and 13.2.2. Anything below those builds on those branches is unpatched.
The serious one is CVE-2026-15815. Plugin extraction didn’t resolve symbolic links safely, so a crafted plugin archive can chain symlinks to escape the plugin directory, write an executable backend binary outside it, and have that binary run with the Grafana server’s privileges. That’s remote code execution. Extraction happens before the signature check, so a valid plugin signature doesn’t prevent the write, and Enterprise carries the same extraction code. The advisory lists two ways in: a plugin that appears legitimate, and an arbitrary archive installed through grafana-cli, GF_INSTALL_PLUGINS or preinstall config.
CVE-2026-76154 is a stored XSS in the Geomap panel’s MapLibre base layer. A user with the Editor role can host a malicious style configuration, and it runs in another user’s session when they open the dashboard. That can escalate to Org Admin. Grafana rates it 7.3.
Grafana lists a third fix, CVE-2026-79656, without an advisory or any published detail. 12.4.11 also carries CVE-2026-12704 — Enterprise-only, a SAML assertion replay that only matters when IdP-initiated login is enabled. That setting is off by default.
Source: Releases · grafana/grafana