Database/Control plane, storage & DevOps
Grafana: renderer keys accepted across instances sharing a renderer_token, allowing user impersonation
Impact
If independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others. A user on one instance can then act as the user with the same numeric ID on another instance, and that user may be an administrator. This matters where one fleet runs separate Grafana instances per tenant or per environment from a shared config template, because the boundary between those dashboards and their data sources stops holding. Only instances with the renderAuthJWT feature toggle enabled are affected, and that toggle is on by default from Grafana 13.0.0.
Who can reach it
An authenticated user (low privilege) on any one Grafana instance that shares a renderer_token with the target instance, reaching it over the network.
What to do
Upgrade Grafana to the fixed release named in the Grafana advisory. The record does not state the fixed version. Restarting the Grafana service is enough, and nodes do not need draining. Until you upgrade, give each independent instance its own unique renderer_token, or disable the renderAuthJWT feature toggle.
References
Related entries
- Flyte: FILE-mounted secrets land in pod spec env vars, readable by anyone with pod readCVE-2026-108728 · Flyte secrets webhook (FILE-mounted secrets written to the SECRETS env var)High
- Grafana: Auth Proxy cache key collision authenticates a low-privileged user as an administratorCVE-2026-14199 · Grafana Auth Proxy authentication (identity cache key built by concatenation)High
- GitLab EE: membership lock not enforced on pre-existing requests, letting users grant access outside the IdPCVE-2026-16255 · GitLab EE (SAML/LDAP instance-wide membership lock)High
- GitLab EE: missing authorization lets a low-privileged member change restricted project settingsCVE-2026-16494 · GitLab EE (project update endpoint authorization)High
- Grafana: alert rule marked as a server-side expression bypasses datasource query authorizationCVE-2026-17183 · Grafana (alert rule server-side expression datasource authorization)High
- GitLab: unauthenticated GraphQL mutations executed via GET through multiplex query handlingCVE-2026-19650 · GitLab CE/EE (GraphQL multiplex query handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.