CVE-2026-102589: Cross-instance user impersonation through image renderer JWTs
When independent Grafana instances share the same [rendering] renderertoken, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Independent Grafana instances are affected when they share the same [rendering] renderer_token and have the renderAuthJWT feature toggle enabled. The feature toggle is enabled by default starting with Grafana 13.0.0.
What access does an attacker need to exploit it?
An attacker needs to be a user on one affected Grafana instance. They could then use an image renderer key issued by that instance to act as a user with the same ID on another instance sharing the renderer token.
What can be done if patching is not immediately possible?
Ensure independent Grafana instances do not share the same [rendering] renderer_token. Disabling the renderAuthJWT feature toggle also removes the affected condition described here.