What’s Vulnerable › Vulnerabilities
CVE-2026-13720: Editor can forge file-provisioning provenance on dashboards via the dashboard API
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-30 · updated 2026-09-30
- Weakness: CWE-285
Description
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Affected products
- Grafana: from 12.0.0 through 12.0.10; from 12.1.0 through 12.1.10; from 12.2.0 through 12.2.11; from 12.3.0 through 12.3.11; from 12.4.0 before 12.4.12; from 13.0.0 before 13.0.10 — fixed in 12.4.12, 13.0.10, 13.1.7, 13.2.3
How to fix
Upgrade to a fixed version: Grafana 12.4.12, 13.0.10, 13.1.7, 13.2.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-13720 or the next vulnerability affects your stack