Grafana 12.4.14 to 13.2.5 Fix Four CVEs; No Patch Below 12.4

Grafana Lines, Affected CVEs and the Release to Install #

Each of the four lines released on October 27 lists the same three fixes, CVE-2026-100105, CVE-2026-88858 and CVE-2026-88967, and 13.2.5 adds CVE-2026-103506. On November 10 Grafana shipped another patch round for every supported line, so the last column names the release to install today.

The CVE-2026-88967 record lists 10.0.0 through 11.6.16, 12.0.0 through 12.2.10 and 12.3.0 through 12.3.11 as affected, and the CVE-2026-88858 record lists the same lines from 7.4.0. Grafana's own fixed-version lists start at 12.4.14 for both, so an 11.6 or 12.3 installation stays exposed to both flaws on every release of its line.

CVE-2026-88967: Azure Monitor Access Token Sent to an Attacker's Server #

A user who can query an Azure Monitor data source can make Grafana send server-side requests to an endpoint the attacker controls, and those requests disclose the data source's Azure access token. The record classes it as server-side request forgery (CWE-918) together with improper input validation and insufficiently protected credentials. The CVSS 3.1 vector, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, means a low-privileged network user is enough, and the changed scope (S:C) fits a token that works against Azure rather than Grafana. Grafana credits the researcher rathina, who reported it through its vulnerability disclosure program. Only instances with an Azure Monitor data source are affected.

CVE-2026-100105: Contact Point Settings Changed Through a Legacy Schema #

Grafana lets an administrator grant permission to edit contact points while protecting some of their fields, such as a webhook's destination URL. According to the CVE record, a user with edit permission but without access to the protected fields can still change them by switching an integration to a legacy schema version. That lets the user redirect alert notifications and can expose the credentials stored in the contact point. The weakness is incorrect authorization, CWE-863, with the same 7.7 vector as the Azure flaw. It affects only 12.4.0 and later, because the record lists no older line.

CVE-2026-88858 and CVE-2026-103506: Viewer Crash and SSO Secrets on 13.2 #

In CVE-2026-88858, a user with only the Viewer role crashes the Grafana server with a crafted server-side math expression that triggers uncontrolled recursion. Grafana adds that a user who can provision alert rules can make the outage persist across restarts. It scores 6.5, and Grafana credits Mukul Goyal for the report.

CVE-2026-103506 lets an authenticated user read SSO client secrets and change instance-wide SSO settings without the required permissions. It scores 8.9 under CVSS 4.0, the highest of the four, but affects only 13.2.0 through 13.2.4 with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is off by default. Grafana credits kazuki-hanai for the report.

November 10: Seven More CVEs in Grafana 13.1.10 and 13.2.6 #

Two weeks later, the 13.1.10 release notes list seven security fixes and the 13.2.6 notes list six of them, all except CVE-2026-107365. Grafana released 13.0.13, 12.4.15 and 13.3.1 the same day. Most of the seven concern Git Sync, Grafana's provisioning of dashboards from a Git repository.

Updating Grafana and Containing the Four October Flaws #

1. Install 13.2.6, 13.1.10, 13.0.13 or 12.4.15 on the matching line, or 13.3.1 on 13.3. Each covers the October fixes as well as the November ones.
2. On 12.3 or older, plan the move to 12.4.15 or a 13.x release: CVE-2026-88967 and CVE-2026-88858 have no fix on those lines.
3. Until the update, find every Azure Monitor data source and limit who can query it. If users outside the team that owns the Azure identity had query access, review that identity's activity in Azure for calls Grafana did not make.
4. On 13.2 with kubernetesSsoSettingsApi enabled, turn the toggle off and rotate the client secrets of every configured SSO provider, since any authenticated user could read them.
5. Compare each contact point's destination URL with the intended one, and rotate webhook or integration credentials stored in contact points that users without access to protected fields could edit.
6. Give each Grafana instance its own renderer_token in the [rendering] section, which CVE-2026-102589 needs to be shared between instances.

Checking a Grafana Instance: Version, Toggles and Data Sources #

The health endpoint returns the running version without authentication. The configuration search shows the toggles and the renderer token named above, including values set through GF_ environment variables. The data source query needs an administrator's service account token and lists the plugin type of every data source, where grafana-azure-monitor-datasource marks the Azure Monitor ones.

curl -s http://localhost:3000/api/health
grep -nE "kubernetesSsoSettingsApi|renderAuthJWT|renderer_token|^\[feature_toggles\]" /etc/grafana/grafana.ini
env | grep -E "GF_FEATURE_TOGGLES|GF_RENDERING"
curl -s -H "Authorization: Bearer $GRAFANA_TOKEN" http://localhost:3000/api/datasources | jq -r '.[].type' | sort | uniq -c