Grafana 12.4.15 released with critical security fixes and timezone updates
Grafana 12.4.15 addresses eight distinct CVEs and updates timezone data to ensure accurate time handling for 2026.
Summary
Grafana has released version 12.4.15, a maintenance update focused heavily on security hardening and temporal accuracy. This release addresses a significant number of vulnerabilities identified as CVEs, which could potentially impact the security posture of observability stacks using Grafana.
Beyond security patches, the update includes a necessary dependency bump for time-related operations. By updating the moment-timezone library, the platform ensures that dashboarding and alerting remain accurate in light of scheduled 2026 timezone changes.
Security patches and temporal accuracy
- Security Vulnerabilities: The release resolves eight specific security flaws, including CVE-2026-102589, CVE-2026-106472, CVE-2026-106475, CVE-2026-107365, CVE-2026-107509, CVE-2026-111000, CVE-2026-81843, and CVE-2026-82014.
- Timezone Management: The project bumped the moment-timezone dependency to version 0.6.6.
- Data Integrity: The timezone update specifically accounts for upcoming 2026 time zone changes to prevent errors in time-series data visualization and scheduling.
Why it matters
System administrators and DevOps engineers managing large-scale observability platforms should prioritize this update to mitigate the risk of the addressed CVEs. The timezone update is critical for organizations relying on precise temporal data for automated alerting and historical reporting.
What to do
- Update Grafana to version 12.4.15 to address eight security vulnerabilities and timezone changes.
Original reference: github.com →