What is CVE-2026-102589?

CVE-2026-102589 is a security advisory published by Grafana Labs Security. Cross-instance user impersonation through image renderer JWTs

Why does CVE-2026-102589 name no CVE ID?

As we last read it, Grafana Labs Security's advisory lists no CVE ID. A vendor can publish an advisory before a CVE record exists for the flaw, and some advisories never get one. CVE IDs are assigned by CVE Numbering Authorities, not by NVD, and we have not measured when, or whether, a CVE record follows.

Which products are affected by CVE-2026-102589?

CVE-2026-102589 affects 1 product, including: Grafana.

CVE-2026-102589No CVE ID named

Cross-instance user impersonation through image renderer JWTs

Vendor

Grafana Labs Security

Published

November 10, 2026

Last Modified

—

📋 Description

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.

🎯 Affected products1

Grafana

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-102589/