CVE-2026-102589
Received
Received - Intake
Grafana Renderer Token Authentication Bypass
Vulnerability report for CVE-2026-102589, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Grafana Labs
Description
Description
When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Grafana | Grafana OSS | From 9.5.0 (inc) to 12.3.11 (inc) |
| Grafana | Grafana OSS | From 12.4.0 (inc) to 12.4.14 (inc) |
| Grafana | Grafana OSS | From 13.0.0 (inc) to 13.0.12 (inc) |
| Grafana | Grafana OSS | From 13.1.0 (inc) to 13.1.9 (inc) |
| Grafana | Grafana OSS | From 13.2.0 (inc) to 13.2.5 (inc) |
| Grafana | Grafana OSS | 13.3.0 |
| Grafana | Grafana Enterprise | From 9.5.0 (inc) to 12.3.11 (inc) |
| Grafana | Grafana Enterprise | From 12.4.0 (inc) to 12.4.14 (inc) |
| Grafana | Grafana Enterprise | From 13.0.0 (inc) to 13.0.12 (inc) |
| Grafana | Grafana Enterprise | From 13.1.0 (inc) to 13.1.9 (inc) |
| Grafana | Grafana Enterprise | From 13.2.0 (inc) to 13.2.5 (inc) |
| Grafana | Grafana Enterprise | 13.3.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-346 | The product does not properly verify that the source of data or communication is valid. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
