Grafana 12.4.14, 13.0.12, 13.1.9, 13.2.5, 13.3: Contact Point Fix

Grafana 12.4.14, 13.0.12, 13.1.9 and 13.2.5 Fix Contact Point Bypass Affecting Releases From 12.4.0 #

The Grafana advisory rates CVE-2026-100105 High, with CVSS 3.1 base score 7.7, and gives a published date of 2026-10-27. The CVE record gives the same score, assigns CWE-863 and is dated 2026-10-28. This suggests the record was filed a day after the advisory was posted. The advisory maps each affected line to its fix: 12.4.14 for 12.4, 13.0.12 for 13.0, 13.1.9 for 13.1 and 13.2.5 for 13.2. The record starts its affected ranges at 12.4.0, so versions before 12.4.0 are not affected.

"A user with permission to edit contact points but not their protected fields can change protected settings"

Grafana advisory

Who Can Reach the Legacy Schema Route #

The condition is permission to edit contact points without permission to edit their protected fields. The advisory says such a user can change protected settings by switching an integration to a legacy schema version. Before you upgrade, list the users and teams that hold contact point edit permission, then compare that list with the people whose work needs it. Because the route depends on the integration's schema version, find the integrations that run on a legacy schema version in the same pass.

Destination URLs and Stored Credentials #

The advisory gives a contact point's destination URL as an example of a protected setting. It says that changing protected settings can redirect alert notifications and expose stored credentials. After upgrading, review each contact point's destination URL and integration settings, starting with integrations on a legacy schema version. This suggests that a redirected destination would send alerts to an endpoint your team did not configure, so confirm that each URL still points where it should.

Grafana 13.3 Adds Cross-Dashboard Variables, Notebooks and Assistant Dashboard Plans #

The Grafana 13.3 release post, dated 2026-10-29, describes four headline features. Cross-dashboard variables, Notebooks, the visual refresh and dashboard plans are in public preview in all editions. Undo turn is generally available in all editions. Three of the preview features need a feature toggle in self-managed Grafana, and the release post names none for dashboard plans or Undo turn.

Cross-Dashboard Variables Are Scoped as Global or Folder #

Cross-dashboard variables let you define a variable once and reuse it across dashboards in an organization. You create them from Dashboards > Variables and scope each one as Global, which is available to every dashboard, or Folder, which is available only to dashboards in the same folder. The release post describes the problem as duplicate work and configuration drift when each dashboard manages its own environment, region or cluster selector.

When you edit a dashboard, add a Global or folder variable from the sidebar, and Grafana shows only the variables that match that dashboard's scope. Viewers can still change the value on the dashboard, while the configuration stays managed centrally. This suggests that a change to a shared selector is made once rather than in every dashboard that uses it. Self-managed Grafana needs the grafana.dashboardGlobalVariables feature toggle.

Notebooks Put Panels, Queries and Assistant Findings in One Document #

Notebooks capture findings from dashboards, Explore and Grafana Assistant in one editable document, with your observations written beside the data. The release post lists three uses: exploring a question with queries and notes side by side, documenting an investigation for the next person, and preparing a post-incident review with the relevant panels already in place. You can create a notebook manually or with Grafana Assistant, and the Notebooks page supports search, filtering, editing and export.

Notebooks are gradually rolling out to Grafana Cloud. Self-managed Grafana needs the dashboard.notebooks feature toggle. This suggests that a post-incident review can keep its panels attached to the write-up, instead of relying on screenshots kept in separate tabs and chat threads.

Visual Refresh Changes Look and Feel, Not Workflows #

The release post calls this the "biggest visual refresh since Grafana 7" and describes it as a visual refresh, not a redesign. It brings new default dark and light themes, softer borders and floating components, resized inputs, drop-downs, buttons and tags, and a revised type scale. Existing workflows and navigation stay the same, and the release post states that there are no breaking changes for plugins.

Plugins that use standard Grafana components and theme tokens pick up the new look automatically, while plugins with custom styling migrate on their own timeline. In self-managed Grafana, enable grafana.visualDesignRefresh to try the new UI. You can switch back to the previous design at any time, so check plugins with custom styling while the toggle is on.

Assistant Dashboard Plans and Undo Turn #

With dashboard plans, you describe what you want to monitor, and Assistant proposes a plan in chat before anything is built. The plan covers the dashboard title, tabs or rows, panels, visualization types and variables. Select Preview to open a read-only version, keep iterating in the conversation, and select Build it when the preview matches what you need. This lets you catch a missing panel or the wrong chart type before the dashboard is created.

After Assistant edits a dashboard, select Undo turn to restore the previous state. If Assistant changed several panels in one request, all of those changes are undone at once. This suggests the feature suits the layout and visualization experiments the release post describes.

Also in this release #

• Data visualization, alerting and Git Sync: further updates listed in the Grafana 13.3 release post, with the complete list in the Grafana changelog and What's New documentation.

Upgrade Checklist #

1. Before upgrading, record the running Grafana version and whether it is Enterprise or OSS, then compare it with the affected ranges from 12.4.0 up to and including 12.4.13, from 13.0.0 up to and including 13.0.11, from 13.1.0 up to and including 13.1.8, and from 13.2.0 up to and including 13.2.4 in the CVE record.
2. Before upgrading, list the users and teams that hold edit permission on contact points.
3. Before upgrading, find the integrations that run on a legacy schema version.
4. Upgrade to 12.4.14, 13.0.12, 13.1.9 or 13.2.5 on your line, following the Grafana upgrade guide that the Grafana 13.3 release post refers to.
5. After upgrading, review each contact point's destination URL and integration settings.
6. In self-managed Grafana, enable grafana.dashboardGlobalVariables, dashboard.notebooks or grafana.visualDesignRefresh only for the features you want to test.
7. After enabling grafana.dashboardGlobalVariables, add a Global or Folder variable to a test dashboard, and after an Assistant edit, select Undo turn.
8. After enabling grafana.visualDesignRefresh, check plugins that use custom styling.