Grafana 13.2.4, 13.1.8, 13.0.11 and 12.4.13 Fix Four Medium-Severity CVEs Covering Git Sync, Prometheus Rule Conversion and Azure Monitor

Overview

Grafana published patch releases on October 13 across four release lines. The v13.2.4 release notes list fixes for CVE-2026-15577, CVE-2026-33374, CVE-2026-93294 and CVE-2026-95502. Grafana’s advisory pages rate all four Medium, with CVSS scores between 5.3 and 6.5.

What We Know

Releases

The same four CVE fixes appear in the notes for v13.1.8 and v13.0.11. The v12.4.13 notes list three of them (CVE-2026-15577, CVE-2026-33374 and CVE-2026-93294) and do not list CVE-2026-95502.

The four advisories

• CVE-2026-15577, titled “Git Sync connection configuration can be modified with read-only access”, is rated Medium at CVSS 6.5, according to Grafana’s advisory. The advisory describes an authorization bypass that lets users or service accounts holding read-only Git Sync provisioning permissions modify connection configurations through the status subresource. On Grafana 12.4, it says, the capability exists only when the experimental provisioning feature toggle is active.
• CVE-2026-33374, titled “Unbounded memory allocation in the Prometheus rule conversion API”, is rated Medium at CVSS 6.5, per Grafana’s advisory. The advisory says the endpoints do not limit request body size, so an authenticated user can trigger unbounded memory allocation that can crash the server through out-of-memory conditions.
• CVE-2026-93294, titled “Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs”, is rated Medium at CVSS 6.3, per Grafana’s advisory. The advisory says users with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond what Grafana requires, using the data source’s Azure identity, and that actual impact is constrained by the Azure role permissions assigned to that identity.
• CVE-2026-95502, titled “Git Sync memory exhaustion via a malicious Git server”, is rated Medium at CVSS 5.3, per Grafana’s advisory. The advisory describes a malicious Git server that can cause Git Sync to consume excessive memory by returning oversized or heavily compressed responses, and notes that exploitation requires an administrator to have configured Git Sync to use that server.

Other items in the notes

The v13.2.4 notes also list an Alerting change, “Strip sensitive headers from oauth2 cross-host redirects”, and a Dashboard change, “Fall back when collection deletion is unsupported”. The v13.0.11 notes carry the same two items and also list a separate entry for CVE-2026-92539, described as an IAM fix for SCIM endpoints in Grafana Enterprise.

What We Don’t Know

• The release notes do not say whether any of the four issues has been exploited in the wild, and the advisory pages reviewed do not state it either.
• The advisory pages express version ranges in lists that differ in format from page to page. Operators should check each advisory for the exact range that applies to their release line rather than relying on this summary.
• This briefing does not cover the CVE-2026-92539 advisory itself, only its mention in the release notes.

Analysis

All four issues are rated Medium rather than High or Critical. Two involve Git Sync, a provisioning feature, and one involves the Prometheus rule conversion API. Based on the advisory text, the memory-related issues are availability risks, while the Azure Monitor and Git Sync configuration issues concern access beyond intended permissions. Deployments that do not use Git Sync or the Azure Monitor data source may be less exposed to the corresponding issues, though the advisories remain the authoritative reference for affected configurations.