Grafana: Origin validation error in image renderer (CVE-2026-102589)
Independent Grafana instances sharing the same renderer_token are susceptible to cross-instance user impersonation due to an origin validation error in the image renderer.
CVE search metadata
CVE search record: CVE-2026-102589. Severity: high. CVSS: 7.1. KEV: no. Product: Grafana. Brief: Grafana: Origin validation error in image renderer (CVE-2026-102589). Brief link: https://feed.craftedsignal.io/briefs/2026-11-grafana-auth-bypass-cve-2026-102589/
Triage facts
Revision 1- Applicability
- Grafana
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 16:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Grafana instances with the renderAuthJWT feature toggle enabled (the default from Grafana 13.0.0) suffer from an origin validation error when independent instances share the same [rendering] renderer_token. In this configuration, an image renderer key issued by one instance is accepted by others, potentially allowing a user on one instance to act as a user with the same ID on another.
Impact
A user on one instance could potentially act as a user with the same ID on a different instance due to the cross-acceptance of image renderer keys.
Recommendation
Ensure that independent Grafana instances do not share the same [rendering] renderer_token configuration value.