# Grafana 13.2.5 patches four CVEs, fixes Git Sync and provisioning bugs

> **Key takeaway:** Grafana 13.2.5 is a security-focused patch release addressing four CVEs alongside Git Sync path handling and provisioning workflow fixes.

**Published:** 2026-10-27T11:37:51+00:00 
**Source:** Grafana Official Releases 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/grafana-1325-patches-four-cves-fixes-git-sync-and-provisioni.html 

## Summary
Grafana has shipped version 13.2.5, a maintenance release for its widely deployed observability platform that patches four security vulnerabilities tracked as CVE-2026-100105, CVE-2026-103506, CVE-2026-88858, and CVE-2026-88967. The release also includes operational improvements to Git Sync and provisioning workflows that affect how dashboard configurations are synchronized from repositories.

For Git Sync, hidden paths are now excluded from repository scans and diffs, reducing noise from metadata files. Provisioning changes ensure that saves from branch previews default to the previewed branch rather than the main branch, and incremental sync operations no longer risk replacing the repository root folder. Two bug fixes address plugin registration timeout handling and dashboard preview rendering when Grafana is served from a sub-path.

## Security and provisioning changes in Grafana 13.2.5
- **Security patches:** Four CVEs are resolved: CVE-2026-100105, CVE-2026-103506, CVE-2026-88858, and CVE-2026-88967. The specific attack vectors are not detailed in the release notes, but the volume of fixes warrants immediate upgrade consideration for production deployments.
- **Git Sync path handling:** Hidden paths (typically dot-prefixed files and directories) are now ignored during repository scans and diff generation, preventing `.git`, `.github`, editor metadata, and other non-configuration files from appearing in synchronization workflows.
- **Provisioning branch workflow:** When users save changes from a branch preview, the default target branch is now the previewed branch itself rather than the repository's default branch, reducing accidental commits to main.
- **Incremental sync safety:** The provisioning system no longer replaces the repository root folder during incremental synchronization, protecting against potential data loss or structural corruption in the local clone.
- **Plugin and sub-path fixes:** A race condition where timed-out plugin registration requests incorrectly marked loaded plugins as unregistered is resolved, and PR dashboard previews now render correctly when Grafana operates behind a reverse proxy with a sub-path configuration.

## Why it matters
Grafana's position as the de facto open-source visualization layer for Prometheus, Loki, Tempo, and Mimir means these security patches affect a substantial portion of the cloud-native monitoring stack. The Git Sync and provisioning refinements are particularly relevant to platform teams practicing GitOps-driven dashboard management, where branch-based workflows and clean repository diffs are operational necessities. Administrators running Grafana in sub-path configurations or with plugin-heavy setups should prioritize this upgrade for both security posture and reduced false-positive alerting.