Cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3agrafanagrafana/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 16:15:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGrafana: Origin validation error in image renderer (CVE-2026-102589)https://feed.craftedsignal.io/briefs/2026-11-grafana-auth-bypass-cve-2026-102589/Wed, 11 Nov 2026 16:15:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-grafana-auth-bypass-cve-2026-102589/Independent Grafana instances sharing the same renderer_token are susceptible to cross-instance user impersonation due to an origin validation error in the image renderer.Grafana instances with the renderAuthJWT feature toggle enabled (the default from Grafana 13.0.0) suffer from an origin validation error when independent instances share the same [rendering] renderer_token. In this configuration, an image renderer key issued by one instance is accepted by others, potentially allowing a user on one instance to act as a user with the same ID on another.

Impact

A user on one instance could potentially act as a user with the same ID on a different instance due to the cross-acceptance of image renderer keys.

Recommendation

Ensure that independent Grafana instances do not share the same [rendering] renderer_token configuration value.

]]>highadvisory