Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102589— Cross-instance user impersonation through image renderer JWTs

Quick assessment

Affected
Grafana Grafana OSS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当独立的 Grafana 实例共享同一个渲染（rendering）的 时，由其中一个实例签发的图像渲染密钥会被其他实例接受，导致一个实例上的用户能够冒充另一个实例上具有相同 ID 的用户（这是来源验证错误）。此漏洞影响启用了 功能开关的实例，该功能自 Grafana 13.0.0 起默认为启用状态。

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102589

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-instance user impersonation through image renderer JWTs
Source: CVE Program / CVE List V5
Vulnerability Description
When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Grafana Grafana OSS 9.5.0 ~ 12.3.11 -
Grafana Grafana Enterprise 9.5.0 ~ 12.3.11 -

II. Public POCs for CVE-2026-102589

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102589

请登录查看更多情报信息。

Other References for CVE-2026-102589 (1)

Same Patch Batch · Grafana · 2026-11-11 · 9 CVEs total

CVE-2026-111000 7.1 HIGH Privilege escalation through folder move in the folders API
CVE-2026-111024 7.1 HIGH Folder permission bypass in the Git Sync repository files API
CVE-2026-13721 6.5 MEDIUM Folder authorization bypass in the Git Sync provisioning files API
CVE-2026-14242 6.5 MEDIUM Authorization bypass in the Git Sync provisioning jobs API
CVE-2026-107509 6.5 MEDIUM Memory exhaustion denial of service in SQL Expressions
CVE-2026-110992 6.5 MEDIUM Path traversal in Git Sync delete and move jobs
CVE-2026-110289 5.5 MEDIUM Git Sync connections send credentials to unvalidated server URLs
CVE-2026-82014 4.3 MEDIUM Team preferences RBAC bypass through the set-home-dash endpoint

IV. Related Vulnerabilities

Same product: Grafana OSS
Same vendor: Grafana
Same weakness: CWE-346