Grafana showed up in security advisories from AlmaLinux, Oracle, and Fedora three times in four days this week — while Grafana Labs itself was busy extending plugin maintenance commitments and recording podcasts about agentic coding. The patching cadence and the marketing cadence are running in parallel universes.

Between Monday and Thursday, grafana and grafana-pcp appeared in LWN security update roundups on Monday, Wednesday, and Thursday. AlmaLinux pushed grafana and grafana-pcp patches on both Monday and Thursday. Oracle shipped grafana and grafana-pcp on Wednesday. The advisories don’t break out CVEs in the LWN summaries, so the severity is unknown from these items alone — but the frequency is notable: three separate distro patch waves in 96 hours suggests either a coordinated embargo lift or overlapping backlogs catching up at once.

None of the three LWN items name the underlying CVEs or affected versions. That gap matters. If you’re running Grafana from distro packages on RHEL-family or Oracle Linux, you have a reason to check your package versions this week. If you’re on Grafana Cloud or upstream OSS binaries, the distro advisories don’t tell you anything useful — distro packages often trail upstream releases by weeks, and the vuln may already be patched in a version you shipped last month.

The plugin maintenance extension

Separate from the security noise, Grafana Labs published an update on the Volkov Labs BI plugin handover. In January, Grafana Labs assumed maintenance of Volkov Labs’ business intelligence plugins with a six-month commitment. That six months is up. The new commitment: maintenance extends through end of 2026.

The post frames this as transparency, and it is more candid than most vendor announcements. They’re explicit that the scope is compatibility with recent Grafana releases, bug fixes, security updates, and community contributions — all on a best-effort basis. “Best-effort” is doing work there. If you’ve built dashboards on the Volkov BI plugin stack — Business Charts, Business Forms, Business Variable — this is not a “fully supported product” situation. It’s a holding pattern while Grafana Labs figures out what to do with plugins that have real user bases but don’t fit their core roadmap. Worth knowing before you deepen that dependency.

Access control and the EKS tutorial

Grafana Labs also published a post on scaling access control in Grafana Cloud, covering RBAC, team-based permissions, and data source isolation for multi-tenant setups. The argument is straightforward: as organizations centralize observability into Grafana Cloud, the access model that worked for a single team breaks under the weight of infrastructure metrics, application logs, business KPIs, and customer data all living in the same instance. The post is vendor documentation more than editorial analysis, but the problem it describes is real.

On the tutorial side, env0 published a walkthrough for Prometheus and Grafana on Amazon EKS. It’s a setup guide, not a benchmark. No numbers on scrape intervals, cardinality limits, or storage costs — the variables that actually determine whether the setup survives a production workload. Worth reading if you’re standing up the stack for the first time; not worth citing in a capacity planning conversation.

The podcast and the signal-to-noise question

Grafana Labs’ Big Tent podcast ran an episode with Anthropic’s Eric Burns on agentic coding and observability. The hosts are Mat Ryer (Senior Director of AI at Grafana Labs) and Tom Wilkie (CTO). The summary mentions “how agentic coding tools have changed the day-to-day of building software at Grafana Labs” — which is a reasonable topic, though the summary doesn’t surface any specific claims worth evaluating. Filed under: Grafana is leaning into the AI narrative, same as everyone else.

Putting the week together: the security advisories are the only items here with immediate operational weight. The plugin extension is a medium-term planning signal. The access control post and EKS tutorial are reference material. The podcast is background noise unless you have 45 minutes and a specific interest in Anthropic’s infrastructure choices.

Check your Grafana package versions now if you’re on rpm-based distros – AlmaLinux, Oracle, and Fedora each pushed security advisories this week, three times in four days. That cadence is a signal, not noise. If you’re running Volkov BI plugins, the extended maintenance commitment from Grafana Labs buys you time, but treat that window as a migration runway rather than a reason to go deeper on the dependency. RBAC and multi-tenant data isolation in Grafana Cloud deserve a spot on your roadmap – the concern is real and growing. The EKS setup guides and vendor podcasts making the rounds this week are fine as background reading, but don’t confuse them for operational guidance you can act on.

---

Receipts

1. LWN Monday advisories · LWN.net — AlmaLinux issued security updates for grafana and grafana-pcp on Monday July 6
2. LWN Wednesday advisories · LWN.net — Oracle issued security updates for grafana and grafana-pcp on Wednesday July 8
3. LWN Thursday advisories · LWN.net — AlmaLinux issued security updates for grafana and grafana-pcp again on Thursday July 9
4. Volkov Labs BI plugin update · Grafana Labs — Grafana Labs extended maintenance of Volkov Labs BI plugins through end of 2026, on a best-effort basis covering compatibility, bug fixes, security updates, and community contributions
5. Grafana Cloud access control · Grafana Labs — Organizations need a scalable way to ensure the right people have access to the right resources as observability becomes more centralized in Grafana Cloud
6. env0 EKS tutorial · env0 Blog — Tutorial for setting up Prometheus and Grafana on Amazon EKS; no benchmark numbers provided
7. Big Tent podcast Anthropic · Grafana Labs — Hosts Mat Ryer (Senior Director of AI) and Tom Wilkie (CTO) spoke with Anthropic’s Eric Burns about agentic coding tools and how they changed day-to-day software building at Grafana Labs