NOTE: This PR is aimed for 12.4 and will/should not be merged until then

Release notice breaking change

Starting in Grafana v12.4, plugin processes no longer receive all host environment variables by default. This change improves security by limiting plugin access to environment variables from the Grafana host process.

Previously, all environment variables from the Grafana process were automatically forwarded to plugin processes. Now, plugins only receive:

• Grafana-specific environment variables (for example, GF_VERSION, GF_EDITION, GF_APP_URL)
• A limited set of permitted host environment variables used for HTTP proxy configuration (HTTP_PROXY, http_proxy, HTTPS_PROXY, https_proxy, NO_PROXY, no_proxy)
• Plugin-specific configuration environment variables (for example, AWS settings, Azure settings, tracing configuration)

Migration

If your plugins require access to additional host environment variables, you can configure Grafana to forward all host environment variables to specific plugins using the forward_host_env_vars configuration option.

Add the following to your grafana.ini file under the [plugins] section:

[plugins]
forward_host_env_vars = plugin-id-1,plugin-id-2,plugin-id-3

Only add plugins to forward_host_env_vars if they require access to host environment variables. Forwarding all environment variables reduces the security isolation between Grafana and plugin processes.