Grafana fixes 11 flaws, three High, in folders and Git Sync

Grafana fixes 11 flaws, three High, in folders and Git Sync

10 November 2026: Grafana Labs has published 11 security advisories for Grafana, three of them rated High at CVSS 7.1: an Editor can make themselves Admin of a folder by moving it (CVE-2026-111000), users can be impersonated across instances that share an image renderer token (CVE-2026-102589), and the Git Sync repository files API ignores folder permissions (CVE-2026-111024). Fixes are in the 12.4, 13.0, 13.1, 13.2 and 13.3 lines, and Grafana reports no exploitation.

Not yet independently verified. Severities and fixed versions are Grafana's own; for four of the medium flaws (CVE-2026-110992, CVE-2026-13721, CVE-2026-82014 and CVE-2026-107365) we have not confirmed the fixed versions, and Grafana reports no exploitation. We will update this when it can be confirmed, and remove this note.

Three High-rated flaws

The folder move is the one most self-managed installations should care about, because it needs only Editor rights. An Editor who moves a folder under one they administer gains Admin over it, and with it the dashboards, alerts and permissions inside. It is fixed in 12.4.15 and 13.0.10.

The renderer flaw needs a particular setup: several Grafana instances sharing one image renderer with the same renderer_token and renderAuthJWT switched on. In that case a user of one instance can be passed off as a user of another. It is fixed in 12.4.15, 13.0.13, 13.1.10, 13.2.6 and 13.3.1. Separate tokens per instance remove the condition.

The third lets a user read or change files in a Git Sync repository outside the folders they are allowed to touch, and is fixed in 13.0.13, 13.1.10, 13.2.6 and 13.3.1.

Git Sync carries most of the rest

Git Sync, which keeps dashboards in a Git repository, accounts for five of the 11. Besides the High-rated files flaw there are authorisation bypasses in the provisioning jobs API (CVE-2026-14242, 6.5) and the provisioning files API (CVE-2026-13721, 6.5), path traversal in delete and move jobs (CVE-2026-110992, 6.5), and connections that send credentials to server URLs nobody validated (CVE-2026-110289, 5.5, fixed in 13.1.10, 13.2.6 and 13.3.1). An instance that does not use Git Sync is clear of all five.

Medium flaws elsewhere

• CVE-2026-107509 (6.5): a Viewer can exhaust memory and crash Grafana with a SQL Expression.
• CVE-2026-106472 (6.3): server-side request forgery through the Prometheus data source resource API, fixed in 12.4.15, 13.0.13 and 13.1.10.
• CVE-2026-107365 (5.3): unintended API access through the Google Cloud Monitoring data source proxy.
• CVE-2026-82014 (4.3): the team preferences endpoint that sets a home dashboard skips role checks.

Which line to move to

A server on 13.3 goes to 13.3.1, on 13.2 to 13.2.6, on 13.1 to 13.1.10, on 13.0 to 13.0.13 and on 12.4 to 12.4.15. The previous batch, on 27 October, fixed an SSO secret exposure and an Azure Monitor SSRF.

Our catalogue lists five data visualisation products.

Sources

• Grafana Labs: Security advisories, 10 November 2026
• Grafana Labs: CVE-2026-111000, privilege escalation through folder move, 10 November 2026
• Grafana Labs: CVE-2026-102589, cross-instance impersonation through image renderer JWTs, 10 November 2026