CVE-2026-102589

Independent Grafana instances are vulnerable to cross-instance user impersonation due to an origin validation error . When instances share the same renderer_token, an image renderer key issued by one instance is accepted by others, allowing a user on one instance to act as a user with the same ID...

EUVD-2026-123545

When independent Grafana instances share the same rendering renderertoken, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another origin validation error. This affects instances with the renderAuthJWT...