Grafana 13.2.6 released with critical security fixes and provisioning updates

Grafana has released version 13.2.6, a maintenance update focused heavily on security hardening and operational stability. The release addresses six specific security vulnerabilities, identified as CVE-2026-102589, CVE-2026-107509, CVE-2026-110992, CVE-2026-111024, CVE-2026-13721, and CVE-2026-14242.

Beyond security, the update introduces enhancements to the provisioning system and time zone handling. These changes affect system administrators managing automated dashboard deployments and users relying on accurate temporal data for observability metrics.

Technical improvements and security patches

• Security Hardening: Resolves six separate CVEs to mitigate potential vulnerabilities within the Grafana platform.
• Provisioning Reliability: Implements new logic to handle repository build timeouts and branch outages, preventing deployment failures during network or Git instability.
• Infrastructure Management: Enables same-host URL changes for connection-backed repositories, providing more flexibility in infrastructure configuration.
• Temporal Accuracy: Updates the moment-timezone and easy-tz libraries to ensure correct handling of 2026 time zone adjustments.
• Search Logic: Fixes a bug in the unified search component where queries consisting entirely of words shorter than three characters returned no results.

Why it matters

This release is critical for DevOps and SRE teams using Grafana for cloud-native observability, as it patches multiple security holes. The improvements to the provisioning system reduce the manual overhead required to manage dashboard-as-code workflows in unstable network environments.