Grafana 13.2.0 went out on 18 August 2026 at 12:48 UTC, published from the project’s official GitHub repository under commit f681b13 with a verified signature, and flagged as the Latest release. It carries two things at once: a High-severity authorization bug in Unified Alerting that got its own advisory the day after, and a genuine batch of feature work that has nothing to do with security. Both matter, but not to everyone equally.
What CVE-2026-17183 actually lets someone do
The advisory, GHSA-f74r-h7qj-c63f, was published to the NVD and the GitHub Advisory Database on 19 August 2026. It rates the issue High, CVSS 3.1 score 7.1, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, classified as CWE-863 (Incorrect Authorization). The affected component is Unified Alerting (ngalert) in Grafana OSS. Reproduction was confirmed on Grafana OSS 13.0.1, and the advisory lists the affected version range as “not yet assessed”, so there is no official span of versions to point at yet.
The bug is a classification mismatch. A user who is authenticated, low-privileged, in the same Grafana organisation, and allowed to create or edit alert rules in a folder they can reach submits an alert rule query with the client-side field queryType set to __expr__, while keeping the UID of a real data source in datasourceUid. The authorization path reads queryType, decides this is a server-side expression, and skips the datasources:query permission check. The evaluator then reads DatasourceUID, resolves the real data source, and runs the query against it.
Authorization trusts one field and execution trusts another. Confidentiality impact is High: whatever the data source credentials configured in Grafana can read, the attacker can read. Integrity is rated Low, because some backends accept queries that change state. No availability impact was demonstrated, and no user interaction is required. The researcher czarflix found it through Grafana Labs’ Intigriti programme, filed as report GRAFANALABS-F996ATD7.
Do you need to update tonight?
Probably not, and the prerequisites are why. Someone needs an authenticated account in your organisation, permission to create or edit alert rules in at least one folder, and the UID of the data source they want to read from. That is a real bar.
If your Grafana instance sits behind a reverse proxy and yours is the only account on it, which describes a lot of homelabs, nobody is in position to use this. Update when you would normally update.
A shared instance is a different conversation. If you handed logins to family or a small team, if self-registration is on, or if you have Editor-level accounts you set up once and forgot about, then anyone who can touch alert rules can pull data from sources you never granted them. That includes whatever your Prometheus or SQL data sources are wired into. No public exploitation has been reported, but the exposure is real in that shape of setup.
According to a release recap published by Elestio on 23 August, the fix was also backported to 13.1.4, 13.0.7, 12.4.9 and 12.3.11 the day before 13.2.0 shipped. If that holds, you can take the patch on your current branch without jumping to a new minor.
The rest of the release
Alerting got the most attention. There is a new Import tab in the alerting settings page, the import-to-GMA wizard can now bring in notification templates, and a pending imported configuration can be reverted instead of being a one-way door. The notifications API moved to v1beta1, and contact point provenance conflicts return 403 now rather than a 500.
Git Sync is the other area with real movement, and it is the part to read before you upgrade if you provision from a repository. Webhooks and user attribution are on by default, jobs get attributed to their author and origin, GitHub Enterprise support is enabled by default, and GitLab and Bitbucket webhooks arrive (some pieces Enterprise-only). You can also override the commit author.
Elsewhere:
- Dashboards nest four levels deep now, with nested tabs. New view panel controls are on by default, and panel query errors and notices are grouped into one UI instead of scattered around.
- Scripted dashboards are deprecated and disabled by default. Worth checking before you upgrade if you still use them.
- The unified home page is enabled for all users, and its feature flag is gone.
- Grafana Live accepts
redis://andrediss://connection URLs inha_engine_address. - One breaking change is listed, in Alerting: the
alertingSaveStateCompressedfeature flag was removed.
The self-hosting fixes are the kind you only notice when they bite you. The PostgreSQL data source no longer fails to initialise when maxOpenConns=0, and epoch millisecond strings no longer parse into NaN. SQLite restores its journal mode when WAL is disabled. Azure Monitor dimension filters migrate correctly. Go moved to 1.26.5.
Upgrading a Docker setup
Nothing exotic if you run the official image: pull, recreate the container, done. Snapshot your database first, as always. The two changes worth reading the notes for are the Git Sync defaults and the scripted dashboards deprecation, both of which alter behaviour without you asking. For most single-user homelabs, the CVE is the less urgent half of this release.
Sources: the official v13.2.0 release notes on GitHub and the Grafana security advisory for CVE-2026-17183.