Origin Validation Error in Grafana Image Rendering Functionality
CVE-2026-102589

7.1HIGH

Key Information:

Vendor

Grafana
Status
Grafana Oss
Grafana Enterprise
Vendor
CVE Published:
11 November 2026

What is CVE-2026-102589?

An origin validation error exists in Grafana's image rendering functionality, where multiple instances may inadvertently share the same renderer_token. This misconfiguration allows a user from one Grafana instance to gain unauthorized access to resources as though they were another user on a different instance. This issue particularly affects configurations with the renderAuthJWT feature enabled, which is the default since Grafana version 13.0.0. As a result, it poses a significant risk for instances that operate in shared environments.

Affected Version(s)

Grafana Enterprise 9.5.0 <= 12.3.11

Grafana Enterprise 12.4.0 <= 12.4.14

Grafana Enterprise 13.0.0 <= 13.0.12

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.