CVE Watch11 de nov. de 2026

CVE-2026-102589

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by th

CVSS

7.1

Alta

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 11 de nov. de 2026 · Última mod.: 11 de nov. de 2026 · CWE-200 · CWE-346 · CWE-863

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.

Referências oficiais

grafana.comhttps://grafana.com/security/security-advisories/cve-2026-102589

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-126920—

—

———Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-126882—

—

———Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-126878—

—

———Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-126872—

—

———Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-126866—

—

———Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)2h CVE-2026-126860—

—

———Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)2h