UpHeron
All vulnerabilities

Servers and applications

CVE-2026-102589

Cross-instance user impersonation through image renderer JWTs

Severity
High 7.1
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Origin validation error (CWE-346)Incorrect authorization (CWE-863)Information exposure (CWE-200)
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
Attacker can
Read data · Change data · Slow it down
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Sources
CVE Program

Description

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.

From the CVE Program.

Affected software

SoftwareAffected versions
GrafanaServers and applications · cna:grafana|grafana enterprise
  • From 9.5.0 up to 12.3.11
  • From 12.4.0 up to 12.4.14
  • From 13.0.0 up to 13.0.12
  • From 13.1.0 up to 13.1.9
  • From 13.2.0 up to 13.2.5
  • From 13.3.0 up to 13.3.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-102589