v13.0.2: [release-13.0.2] patch: apply patches for June 2nd release (#125790)
2026-06-03T08:51:39Z•aefa7735bc886f60e864c734c384e5c401398a3640066b11a8d42e5ee3ab11f3
authngeomapgrafanalokipath-traversalrequest-body-sizesecurity-patchtablengtemplate-injectiontempo
What happened
Grafana released multiple security patch releases (notably v13.0.2 and 13.0.1+security-01) addressing several vulnerabilities across components: path traversal in Loki and Tempo data sources, template injection in tableng, Geomap URL/attribution sanitization after variable interpolation, capped request body size for the web/bind handler, and an AuthN metric label fix for unrecognized client types. Multiple CVEs are referenced across the releases; administrators should upgrade affected Grafana installations to the patched releases as soon as possible.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- grafana_grafana_releases
- Record identifier
- aefa7735bc886f60e864c734c384e5c401398a3640066b11a8d42e5ee3ab11f3
- Enrichment time
- 2026-06-03T08:51:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.