Observability
Grafana: supported versions, open vulnerabilities and status today
Grafana 13.2, 13.1, 13.0 and 12.4 are supported (13.1 until Mar 20, 2027); 12.3 reached end of life on Aug 19, 2026; the latest release is 13.2.4. 4 high or critical advisories for Grafana were published in the last 12 months; 2 advisories (CVE-2021-43798, CVE-2021-39226) are on CISA’s list of vulnerabilities exploited in the wild. Grafana Status shows 2 open incidents: Grafana: Phone call notifications to numbers in Russia and Kazakhstan are blocked.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS, Grafana Status and deps.dev.
- Latest release
- 13.2.4
- GitHub stars
- 77.3k
- Licence
- AGPL-3.0
- OpenSSF Scorecard
- 6.8 / 10
Supported versions
Security advisories
11 advisories published in the last 12 months, 4 of them high or critical. 66 in total since records began. Checked packages: github.com/grafana/grafana.
Older advisories CISA lists as exploited in the wild
- CVE-2021-43798 added ; fixed in 8.0.7, 8.1.8, 8.2.7 and 8.3.1.
- CVE-2021-39226 added ; fixed in 7.5.11 and 8.1.6.
Grafana: Pre-authentication denial of service in the public dashboard query handler
Fixed in 1.9.2-0.20260616075434-82ef13993059.
EPSS: top 64%Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
Fixed in 1.9.2-0.20260616075434-82ef13993059.
EPSS: top 78%Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.
Fixed in 1.9.2-0.20260616075434-82ef13993059.
EPSS: top 63%Grafana Incorrect Privilege Assignment vulnerability
Fixed in 12.0.7, 12.1.4 and 12.2.2.
EPSS: top 3%
Status now
Grafana: Phone call notifications to numbers in Russia and Kazakhstan are blocked
Incident status: investigating.
Grafana: IRM Unable to Send SMS to Thailand Numbers
Incident status: identified.
39+ incidents in the last 90 days (10 major). Most recent major: “Tempo Write Failures in prod-us-central-0” (2026-10-15). Consider retries, timeouts and a fallback path for this dependency. Not counted: 11 notices marked no impact.
Licence
Grafana is AGPLv3 since Grafana 8
Grafana Labs relicensed from Apache 2.0 to AGPLv3 in 2021. Self-hosting unmodified is fine; if you modify Grafana and serve it to users, you must publish your changes.
Maintenance and supply chain
OpenSSF Scorecard 6.8 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 2 issue updates found in the last 90 days.
Weakest checks
- Unsigned releases (Signed-Releases 0/10)
- No static analysis (SAST 0/10)
- Over-privileged CI tokens (Token-Permissions 2/10)
Alternatives
Prometheus
Open-source monitoring and alerting toolkit
Strengths
- Free and open-source
- Powerful query language (PromQL)
Trade-offs
- Requires self-hosting and management
- No long-term storage by default
Datadog
Comprehensive monitoring and analytics platform
Strengths
- All-in-one platform (metrics, logs, traces)
- Beautiful dashboards
Trade-offs
- Vendor lock-in
- Requires agent installation
New Relic
Full-stack observability platform
Strengths
- Comprehensive observability
- Real user monitoring (RUM)
Trade-offs
- Vendor lock-in
- Complex UI for beginners
Dynatrace
AI-powered full-stack monitoring and AIOps platform
Strengths
- Advanced AI/ML for root cause analysis
- Automatic dependency mapping (Davis AI)
Trade-offs
- Complex setup for advanced features
- Vendor lock-in
Example stacks with Grafana
Docs and release notes
Check Grafana in your own stack
This page checks Grafana in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.