{"id":"CVE-2026-102589","kind":"vulnerability","aliases":["CVE-2026-102589"],"related":[],"title":"Grafana: shared renderer token lets one instance's users act on another","description":"When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.","summary":"When independent Grafana instances share the same renderer_token, an image renderer key issued by one instance is accepted by the others. A user on one instance can then act as the user with the same ID on another instance.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"grafana","fixed":["13.3.1","13.2.6","13.1.10","13.0.13","12.4.15"],"affected":"< 13.3.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["grafana","image-renderer","renderer","runtime","self-hosted"],"not_affected_if":["no-image-renderer","renderauthjwt-disabled","single-instance","unique-renderer-token"],"how_to_check":"1) Run grafana server -v and compare with the fixed versions: 13.3.1, 13.2.6, 13.1.10, 13.0.13, 12.4.15. 2) Check [rendering] renderer_token in grafana.ini or GF_RENDERING_RENDERER_TOKEN: the same value on more than one Grafana instance is the exposed case. 3) Check whether the renderAuthJWT feature toggle is on (default since 13.0; JWT mode signs render keys with renderer_token). Also check older versions if you enable renderAuthJWT yourself. The affected lower bound is not stated on the sources read.","fix":"Update Grafana to 13.3.1, 13.2.6, 13.1.10, 13.0.13 or 12.4.15 (released 2026-11-10). Also give every instance its own unique [rendering] renderer_token (not empty, not the default '-') and set the same value in that instance's Image Renderer.","status":"open","published_at":"2026-11-11T15:17:12+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:45+00:00","updated_at":"2026-11-11T15:33:01+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T15:29:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: shared renderer token lets one instance's users act on another","impact":"medium","summary":"When independent Grafana instances share the same renderer_token, an image renderer key issued by one instance is accepted by the others. A user on one instance can then act as the user with the same ID on another instance.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["grafana","self-hosted","renderer"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"a user on one instance acts as a same-ID user elsewhere","analyst_note":"Fixed versions and the vendor advisory are not in the sources; find the Grafana security advisory for CVE-2026-102589 to confirm the fix and affected ranges.","how_to_check":"- Check the `[rendering]` section of the Grafana config for `renderer_token`; a value shared across instances is the exposed case.\n- Check whether the `renderAuthJWT` feature toggle is enabled; it is the default from Grafana `13.0.0`.\n- Check the Grafana version with `grafana server -v`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unique-renderer-token","renderauthjwt-disabled","single-instance"],"who_is_affected":"Only instances that share the same [rendering] renderer_token with another independent Grafana instance are affected, and the renderAuthJWT feature toggle must be enabled, which is the default from Grafana 13.0.0. Instances with unique renderer tokens, or with renderAuthJWT disabled, are not exposed by this description. Teams running several Grafana installs from one config template should check this first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000772,"input_tokens":4556,"output_tokens":632,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions and the vendor advisory are not in the sources; find the Grafana security advisory for CVE-2026-102589 to confirm the fix and affected ranges.","search":"'-102589':15A,18A '-2026':14A,17A '13.0.0':125C 'accept':47B,88C 'act':10A,58B,99C 'affect':113C 'anoth':12A,67B,108C 'could':98C 'cve':13A,16A 'default':122C 'enabl':120C 'error':111C 'featur':118C 'grafana':1A,19A,20B,31B,71C,124C 'host':28B 'id':65B,106C 'imag':22B,39B,80C 'image-render':21B 'independ':30B,70C 'instanc':7A,32B,45B,55B,68B,72C,86C,97C,114C 'issu':42B,83C 'key':41B,82C 'let':5A 'one':6A,44B,54B,85C,96C 'origin':109C 'other':50B,91C 'render':3A,23B,24B,36B,40B,76C,77C,81C 'renderauthjwt':117C 'runtim':25B 'self':27B 'self-host':26B 'share':2A,33B,73C 'toggl':119C 'token':4A,37B,78C 'user':9A,52B,61B,94C,102C 'valid':110C","nicknames":[],"mitigations":[],"who_affected":"Teams running more than one self-hosted Grafana instance that use the Image Renderer and share one renderer_token across them (or reuse a common default). In JWT render auth mode, a render key issued by one instance is accepted by the others, so a user on one instance can act as the user with the same ID on another. Single-instance setups, instances with unique tokens, and Grafana Cloud/managed hosting that you do not operate can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T15:33:01Z","by":"analyst","doc":"https://github.com/grafana/grafana/releases","run_id":3565}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["grafana"],"ptokens":["grafana"],"labels":["grafana","high","imagerenderer","renderer","runtime","selfhosted"],"campaign_type":null,"search_a":"'-102589':15A,18A '-2026':14A,17A 'act':10A 'anoth':12A 'cve':13A,16A 'grafana':1A,19A 'instanc':7A 'let':5A 'one':6A 'render':3A 'share':2A 'token':4A 'user':9A","search_b":"'accept':47B 'act':58B 'anoth':67B 'grafana':20B,31B 'host':28B 'id':65B 'imag':22B,39B 'image-render':21B 'independ':30B 'instanc':32B,45B,55B,68B 'issu':42B 'key':41B 'one':44B,54B 'other':50B 'render':23B,24B,36B,40B 'runtim':25B 'self':27B 'self-host':26B 'share':33B 'token':37B 'user':52B,61B","search_c":"'13.0.0':125C 'accept':88C 'act':99C 'affect':113C 'anoth':108C 'could':98C 'default':122C 'enabl':120C 'error':111C 'featur':118C 'grafana':71C,124C 'id':106C 'imag':80C 'independ':70C 'instanc':72C,86C,97C,114C 'issu':83C 'key':82C 'one':85C,96C 'origin':109C 'other':91C 'render':76C,77C,81C 'renderauthjwt':117C 'share':73C 'toggl':119C 'token':78C 'user':94C,102C 'valid':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102589","severity":null,"published_at":"2026-11-11T15:17:12+00:00","modified_at":"2026-11-11T15:17:12+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-102589:3565","url":"https://github.com/grafana/grafana/releases","severity":null,"published_at":"2026-11-11T15:33:01+00:00","modified_at":"2026-11-11T15:33:01+00:00","first_seen_at":"2026-11-11T15:33:01+00:00","fetched_at":"2026-11-11T15:33:01+00:00","note":"Fix versions read in Grafana's own release notes (GitHub releases/CHANGELOG). No dedicated grafana.com advisory page found yet, so affected lower bound, severity and exact mechanism are unconfirmed; only fix is marked verified. X not checked.","cites":["https://github.com/grafana/grafana/releases","https://grafana.com/whats-new/2026-04-14-rendering--default-auth-mode-changed-to-use-jwts/","https://github.com/grafana/grafana/pull/121408"]}],"documents":[{"id":11646,"url":"https://github.com/grafana/grafana/releases","title":"Grafana releases: 13.3.1, 13.2.6, 13.1.10, 13.0.13, 12.4.15 fix CVE-2026-102589","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":126654,"url":"https://grafana.com/whats-new/2026-04-14-rendering--default-auth-mode-changed-to-use-jwts/","title":"Rendering: Default auth mode changed to use JWTs","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":126655,"url":"https://github.com/grafana/grafana/pull/121408","title":"Rendering: Prohibit usage of empty/default render auth token in JWT mode","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}