Grafana: Cross-instance user impersonation via image renderer tokens
Summary
Grafana OSS and Grafana Enterprise accept image renderer keys issued by another instance when both instances share the same [rendering] renderer_token. An authenticated user on one instance can act as the user with the same ID on another instance, which allows reading and changing data there (CVSS 7.1). The flaw applies when the renderAuthJWT feature toggle is enabled, which is the default from Grafana 13.0.0.
Affected
- Grafana OSS and Grafana Enterprise 9.5.0 to 12.3.11
- Grafana OSS and Grafana Enterprise 12.4.0 to 12.4.14
- Grafana OSS and Grafana Enterprise 13.0.0 to 13.0.12
- Grafana OSS and Grafana Enterprise 13.1.0 to 13.1.9
- Grafana OSS and Grafana Enterprise 13.2.0 to 13.2.5
- Grafana OSS and Grafana Enterprise 13.3.0 (default configuration: unaffected)
Fixed in
- Grafana v13.3.1 lists this CVE among its security fixes.
- Fixed builds for the other branches: Unknown. Check the vendor advisory for the version that matches your branch.
Workaround
- Set a unique, non-default renderer_token on each Grafana instance so that keys cannot be reused across instances.
- Setting renderAuthJWT to false is a documented alternative, but its security impact compared with the patched build is unknown. Test it before relying on it.
- Restrict which hosts can reach the image renderer. This is good practice but does not fix the flaw.
Exploitation
- No known exploitation in the wild at the time of writing.
- No public proof of concept found at the time of writing. The CVE was published on 2026-11-11 and its NVD status is still Received, so the data may change.
Our recommendation
- Check whether renderAuthJWT is enabled and whether the image renderer is in use.
- Check whether renderer_token is set, non-default and unique per instance, including values in Helm charts and Docker Compose files.
- Upgrade to Grafana 13.3.1 or the vendor-listed fixed build for your branch after verifying the advisory.
- Review user accounts on each instance, since any valid user is the relevant attacker.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Grafana security advisory CVE-2026-102589 grafana.com
- Grafana v13.3.1 release github.com
- Grafana image renderer documentation grafana.com
- Grafana v13.0 upgrade guide grafana.com
- Canadian Centre for Cyber Security: Grafana security advisory AV26-285 www.cyber.gc.ca
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:23.
Original description (NVD)
When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.