IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.1Alta

CVE-2026-102589Cross-instance user impersonation through image renderer JWTs

Grafana Grafana OSS; Grafana Grafana Enterprise Publicada: (hace 21 horas)

Descripción

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.

Debilidad (CWE): CWE-346CWE-863CWE-200

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Grafana Grafana Enterprise 9.5.0 – ≤ 12.3.11, 12.4.0 – ≤ 12.4.14, 13.0.0 – ≤ 13.0.12, 13.1.0 – ≤ 13.1.9, 13.2.0 – ≤ 13.2.5, 13.3.0 – ≤ 13.3.0
Grafana Grafana OSS 9.5.0 – ≤ 12.3.11, 12.4.0 – ≤ 12.4.14, 13.0.0 – ≤ 13.0.12, 13.1.0 – ≤ 13.1.9, 13.2.0 – ≤ 13.2.5, 13.3.0 – ≤ 13.3.0

Referencias y parches

CVE recientes del mismo producto — Grafana

5.5Media
CVE-2026-110289

Git Sync connections send credentials to unvalidated server URLs

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private…

7.1Alta
CVE-2026-111024

Folder permission bypass in the Git Sync repository files API

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned da…

7.1Alta
CVE-2026-111000

Privilege escalation through folder move in the folders API

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move AP…

6.5Media
CVE-2026-107509

Memory exhaustion denial of service in SQL Expressions

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).

6.5Media
CVE-2026-110992

Path traversal in Git Sync delete and move jobs

Grafana Grafana OSS; Grafana Grafana Enterprise

A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local files…

4.3Media
CVE-2026-82014

Team preferences RBAC bypass through the set-home-dash endpoint

Grafana Grafana Enterprise; Grafana Grafana OSS

Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their ch…