Grafana 12.3 ends August 19 —
and 12.4 outlives every Grafana 13.

Grafana 12.3 reaches end of life on August 19, 2026 — four days after this piece was published. It was released on November 19, 2025 and gets exactly the nine months Grafana's policy promises, not a day more.

The interesting part is what the same policy does to the versions around it. Grafana's extended fifteen-month window applies only to the last minor release of a major line — and that produces a genuinely strange table: Grafana 12.4 outlives every Grafana 13 released so far. The older release is the longer-supported one, and by a wide margin.

What stops on August 19

Grafana 12.3 shipped on November 19, 2025. Under Grafana's support policy each minor release gets nine months of security support from its release date, so the window closes on August 19, 2026. Active development left 12.3 much earlier — on February 24, 2026, the day 12.4 shipped — and everything since has been security backports.

The most recent of those is 12.3.10, published August 4, 2026. Unless Grafana ships an emergency fix in the next few days, that is the last patch the 12.3 line will ever receive. The dashboards keep rendering after the 19th; what ends is the flow of security fixes into a service that typically holds read credentials for every data source you have pointed it at.

The nine-month rule and the fifteen-month exception

Grafana's policy, in its own words: “Each minor release is supported for 9 months after its release date” and “the last minor release of a major version receives extended support for 15 months after its release date.”

Our data confirms the rule runs exactly to the day across the whole 12.x line. Four regular minors, four nine-month lifespans; one final minor, one fifteen-month lifespan:

Note what “active support ended” means in that table: the moment the next minor ships, the previous one stops getting features and bug fixes and lives out the rest of its window on security backports alone. A version is only fully supported while it is the newest one — usually about two months.

There is a subtlety worth naming: a minor only becomes “the last of its line” in retrospect, when the next major ships. 12.4 earned its fifteen months the day Grafana 13.0 came out. Until that moment, nothing about 12.4 looked special.

Why 12.4 outlives Grafana 13.0 and 13.1

Put the extended window next to the ordinary one and the ranking inverts. Grafana 13.0 and 13.1 are newer than 12.4 — and both die first:

12.4 outlives 13.0 by more than four months and 13.1 by two. If you are on 12.3 and your only goal is the longest runway for the least work, the answer is not the newest release — it is the next minor up: same major version, no breaking changes to absorb, supported until May 2027.

The honest counterweight: 12.4 is the end of the road for the 12 line. When it expires, the jump to 13 (or whatever is current by then) is mandatory, and you will have deferred rather than avoided it. Moving to 13.1 now costs the major-version upgrade today but puts you on the line where releases keep coming. The wrong answer is the one in between — 13.0 has the major-upgrade cost and the earliest expiry of the three.

What is already dead — and why unpatched Grafana is a target

We track 28 Grafana release lines. As of publication, 24 of them are already past end of life — on August 19 that becomes 25 of 28. The entire 11.x line is gone: Grafana 11.6, the last and longest-lived of it, expired on June 25, 2026. Anyone still on 11.x has been running unsupported software for weeks, and on 10.x or earlier for far longer.

Whether that matters is not hypothetical for Grafana. Two Grafana CVEs sit in CISA's Known Exploited Vulnerabilities catalog — CVE-2021-43798, the pre-auth path traversal that let attackers read arbitrary files off Grafana servers, and CVE-2021-39226, a snapshot authentication bypass. Both were exploited in the wild. Grafana instances are disproportionately internet-facing for what they hold: a typical install carries data-source credentials, and a compromised one is a map of your infrastructure with the keys attached.

That history is why Grafana's product-level EOL Risk Score carries the full CISA KEV factor, and why a version past its support window — scoring 65 like 12.2, or 65 like 11.6 — sits in our High band rather than aging gracefully.

What to do

If you are on 12.3: move to 12.4. It is a minor upgrade within the same major, and it is the longest-supported version Grafana currently ships — to May 24, 2027. Do it before the 19th and the whole exercise is routine.

If you are planning the 13 jump anyway: go directly to 13.1, not 13.0 — 13.0 expires January 9, 2027, ten weeks before 13.1 does, for the same upgrade effort.

If you are on 11.x or older: you are past end of life today, not on the 19th. Prioritise the upgrade over waiting for a maintenance window; the KEV history above is the argument to put in front of whoever owns the risk register.

If you cannot move before the 19th: the standard controls for unpatched services apply with unusual force here — take the instance off the public internet, review which data sources it can reach and with what privileges, and record the decision with a date attached. An end-of-life dashboard with production credentials is exactly what auditors write up.

Every Grafana release line, its dates and its EOL Risk Score are on the Grafana lifecycle page, updated at every build from upstream data.