Grafana 13.2.2

Grafana 13.2.2 landed on September 15, 2026 as a security-focused patch on the 13.2 line. Both the open source and Enterprise editions ship the same fixes in this release.

Security Patches

The headline item is a batch of security fixes led by CVE-2026-15815. The Grafana team does not disclose exploit details in the short release summary, so operators should treat the fix as urgent and upgrade promptly, especially for internet-facing instances.

• CVE-2026-15815 resolved as part of the hardening pass
• Additional security fixes bundled in the same patch
• Upgrade recommended for both OSS and Enterprise deployments

Datasource and AWS changes

The AWS SDK dependency was refreshed so Grafana uses the new sigv4 middleware. This matters most if you run CloudWatch or other AWS-backed data sources, since request signing now flows through the updated middleware path.

Bug Bashes

• Dashboards: preserve the query variable refresh setting when importing v2 dashboards (#132089)
• Provisioning: fix folder rename UID handling so provisioned dashboards stay correctly associated

What next

If you are on 13.2 or earlier, this is a low-risk point release. Back up your configuration, review your datasource connections after the AWS SDK change, and verify dashboard variable behavior on import. A restart of the running instance completes the upgrade.