---
id: "CVE-2026-102589"
page: "https://infrastack.ai/live/CVE-2026-102589"
kind: "vulnerability"
aliases: ["CVE-2026-102589"]
title: "Grafana: shared renderer token lets one instance's users act on another"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "grafana", "fixed": ["13.3.1", "13.2.6", "13.1.10", "13.0.13", "12.4.15"], "affected": "< 13.3.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["grafana", "image-renderer", "renderer", "runtime", "self-hosted"]
not_affected_if: ["no-image-renderer", "renderauthjwt-disabled", "single-instance", "unique-renderer-token"]
published_at: "2026-11-11T15:17:12+00:00"
first_seen_at: "2026-11-11T15:27:49+00:00"
updated_at: "2026-11-11T15:33:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102589", "first_seen_at": "2026-11-11T15:27:49+00:00"}, {"source": "analyst", "url": "https://grafana.com/whats-new/2026-04-14-rendering--default-auth-mode-changed-to-use-jwts/", "first_seen_at": "2026-11-11T15:33:01+00:00", "cites": ["https://grafana.com/whats-new/2026-04-14-rendering--default-auth-mode-changed-to-use-jwts/", "https://github.com/grafana/grafana/releases", "https://github.com/grafana/grafana/pull/121408"]}]
exploit_sources: []
---

# Grafana: shared renderer token lets one instance's users act on another

Link for people: https://infrastack.ai/live/CVE-2026-102589 (this .md is for agents)

When independent Grafana instances share the same renderer_token, an image renderer key issued by one instance is accepted by the others. A user on one instance can then act as the user with the same ID on another instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:grafana affected < 13.3.1 fixed 13.3.1, 13.2.6, 13.1.10, 13.0.13, 12.4.15

## How to check

1) Run grafana server -v and compare with the fixed versions: 13.3.1, 13.2.6, 13.1.10, 13.0.13, 12.4.15. 2) Check [rendering] renderer_token in grafana.ini or GF_RENDERING_RENDERER_TOKEN: the same value on more than one Grafana instance is the exposed case. 3) Check whether the renderAuthJWT feature toggle is on (default since 13.0; JWT mode signs render keys with renderer_token). Also check older versions if you enable renderAuthJWT yourself. The affected lower bound is not stated on the sources read.

## Fix

Update Grafana to 13.3.1, 13.2.6, 13.1.10, 13.0.13 or 12.4.15 (released 2026-11-10). Also give every instance its own unique [rendering] renderer_token (not empty, not the default '-') and set the same value in that instance's Image Renderer.

## Timeline

- 2026-11-11T15:27:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102589
- 2026-11-11T15:33:01+00:00 analyst https://grafana.com/whats-new/2026-04-14-rendering--default-auth-mode-changed-to-use-jwts/ — Fix versions read in Grafana's own release notes (GitHub releases/CHANGELOG). No dedicated grafana.com advisory page found yet, so affected lower bound, severity and exact mechanism are unconfirmed; only fix is marked verified. X not checked.

## Documents

- [describes] Rendering: Default auth mode changed to use JWTs https://grafana.com/whats-new/2026-04-14-rendering--default-auth-mode-changed-to-use-jwts/
- [fix] Grafana releases: 13.3.1, 13.2.6, 13.1.10, 13.0.13, 12.4.15 fix CVE-2026-102589 https://github.com/grafana/grafana/releases
- [mentions] Rendering: Prohibit usage of empty/default render auth token in JWT mode https://github.com/grafana/grafana/pull/121408

## From the sources

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_