CVE WatchNov 11, 2026

CVE-2026-102589

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by th

CVSS

7.1

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-200 · CWE-346 · CWE-863

EPSS · 30d

Not enough EPSS history yet.

Technical description

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.

Official references

grafana.comhttps://grafana.com/security/security-advisories/cve-2026-102589

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-126920—

—

———Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-126882—

—

———Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-126878—

—

———Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-126872—

—

———Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-126866—

—

———Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)2h CVE-2026-126860—

—

———Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)2h