CVE-2026-13720
Fixed in a distro release EPSS <1%CVSS 5.4
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Products: Grafana OSS, Grafana Enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-12.2 | no fix |
| Chainguard | grafana-12.3 | no fix |
| Chainguard | grafana-fips-12.2 | no fix |
| Chainguard | percona-grafana | no fix |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.12-0.2.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.7-0.1.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.3-0.1.hum1 |
| Wolfi | grafana-12.3 | no fix |