CVE-2026-102589
Cross-instance user impersonation through image renderer JWTs
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.
| CWE | CWE-346 CWE-863 CWE-200 |
| Vendor | grafana |
| Product | grafana oss |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for grafana grafana oss
Be the first to know when new high vulnerabilities affecting grafana grafana oss are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Grafana / Grafana OSS
9.5.0 ≤ 12.3.11 12.4.0 ≤ 12.4.14 13.0.0 ≤ 13.0.12 13.1.0 ≤ 13.1.9 13.2.0 ≤ 13.2.5 13.3.0 ≤ 13.3.0
Grafana / Grafana Enterprise
9.5.0 ≤ 12.3.11 12.4.0 ≤ 12.4.14 13.0.0 ≤ 13.0.12 13.1.0 ≤ 13.1.9 13.2.0 ≤ 13.2.5 13.3.0 ≤ 13.3.0