Grafana 13.3.1 released with multiple security fixes and timezone updates

Grafana has released version 13.3.1, a maintenance update focused heavily on security hardening and data accuracy. The release addresses six specific vulnerabilities identified as CVE-2026-102589, CVE-2026-107509, CVE-2026-110992, CVE-2026-111024, CVE-2026-13721, and CVE-2026-14242.

Beyond security patches, the update includes functional improvements for time-based data visualization and infrastructure provisioning. It specifically updates internal libraries to ensure time zone calculations remain accurate for the upcoming 2026 calendar year changes.

Technical changes in Grafana 13.3.1

• Security Hardening: Resolves six separate CVEs (CVE-2026-102589, CVE-2026-107509, CVE-2026-110992, CVE-2026-111024, CVE-2026-13721, and CVE-2026-14242) to mitigate potential exploits.
• DateTime Accuracy: Updates the moment-timezone and easy-tz libraries to incorporate official 2026 time zone adjustments, preventing temporal drift in dashboards.
• Provisioning Logic: Enhances connection-backed repositories by allowing same-host URL changes during the provisioning process.

Why it matters

This update is critical for system administrators and DevOps engineers managing observability stacks, as it patches multiple security vulnerabilities. The timezone updates ensure that long-term monitoring data and scheduled alerts remain accurate during the 2026 transition period.