12.4.0
2026-03-05T08:51:40Z•710dc28a65df8f289cac27ee0756d7156e1ec8f7e5669d97096ceabec931c04b
12.4.0auth-bypass-fixauthorizationgo-updategrafanarbacrelease-notesresource-limitingsecurity-fixxss
What happened
Grafana released multiple updates (including v12.4.0 and several 12.x patches in Feb–Mar 2026). Notable security-related changes: v12.4.0 adds a missing scope check on dashboards (PR #116885) and new RBAC permissions for alerting enrichments; earlier 12.x patches introduce HTML sanitization in TraceView (mitigates XSS, PRs #117866/#117867), changes to public dashboard annotation time handling, and limits on expanded notification template sizes (mitigation for large template expansion). Additional non-security changes include Go updated to 1.25.7 and various bug fixes.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- grafana_grafana_releases
- Record identifier
- 710dc28a65df8f289cac27ee0756d7156e1ec8f7e5669d97096ceabec931c04b
- Enrichment time
- 2026-03-05T08:51:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.