v12.4.4

2026-06-04T08:51:41Z•177b139a745ff1cfd19cf3a7ed550b0d6c6291ed77ef3c4bb574768dea59d2ea

authndos-mitigationgeomapgrafanalokipatchpath-traversalreleaserequest-body-limitsecuritytablengtemplate-injectiontempovulnerability

Open source link →

What happened

Grafana released multiple maintenance/security builds (v11.6.14+... through v13.0.2) addressing multiple vulnerabilities. Fixes include path traversal vulnerabilities in Loki and Tempo data sources, template injection in tableng, Geomap URL/attribution sanitization, capping request body size (mitigates large-body DoS), and authentication metric label handling. Several CVEs are referenced across releases; partner acknowledgements and internal VUL IDs (e.g., VUL-2026-0062/0072/0073/0074/0077/0082/0083) are noted.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: grafana_grafana_releases
Record identifier: 177b139a745ff1cfd19cf3a7ed550b0d6c6291ed77ef3c4bb574768dea59d2ea
Enrichment time: 2026-06-04T08:51:41Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records