CVE-2026-85152: 
Grafana vulnerability analysis and mitigation

CVE-2026-85152 is a cross-origin cache poisoning and authentication bypass vulnerability in the Node.js HTTP client library undici. It was introduced as a regression in version 8.10.0 and affects versions 8.10.0 and 8.10.1. The flaw allows unauthenticated network attackers to have cached responses from one origin served for requests to a different, trusted origin, enabling cross-origin information disclosure, persistent cache poisoning, and full authentication bypass. It was disclosed on September 4, 2026, with a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an Origin Validation Error (CWE-346): when interceptors.cache() or interceptors.deduplicate() is composed directly onto a Client or Pool dispatcher (rather than an Agent), undici omits the destination origin from the cache and request-deduplication keys. The internal key falls back to an empty origin string, meaning requests to different upstream origins that share the same HTTP method, path, and relevant headers are treated as identical cache entries. An attacker who controls one upstream origin can pre-populate the shared cache with a crafted response; subsequent requests to a different, trusted origin with matching keys will receive the attacker's response instead. The reporter demonstrated a full JWKS cache poisoning chain where a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer without the trusted origin ever being contacted. Applications using an Agent are not affected because its dispatch options carry the request origin explicitly (GitHub Advisory).

Successful exploitation enables cross-origin information disclosure, persistent cache poisoning, and complete authentication bypass. An unauthenticated attacker can cause the application to accept forged JWT tokens (signed with an attacker-controlled key) as valid credentials from a trusted issuer, effectively bypassing all token-based authentication. Sensitive responses intended for one origin can be read by requests targeting a different origin, and poisoned cache entries persist until evicted, meaning the impact can outlast the initial attack window. Confidentiality and integrity are both rated High; availability is not directly impacted (GitHub Advisory, Red Hat CVE).

As of the disclosure date (September 4, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high attack complexity — the attacker must be able to control a response from one origin and arrange for the shared cache to be populated before a victim request to the trusted origin is made — which limits opportunistic exploitation (GitHub Advisory, Red Hat CVE).

1. Identify a vulnerable deployment: Locate a Node.js application using undici 8.10.0 or 8.10.1 with interceptors.cache() or interceptors.deduplicate() composed directly onto a shared Client or Pool that dispatches requests to multiple upstream origins.
2. Control a reachable origin: Establish or compromise one of the upstream origins the application communicates with (e.g., an attacker-controlled JWKS/OAuth endpoint).
3. Craft a poisoning response: Serve a cacheable HTTP response from the attacker-controlled origin with headers (method, path, relevant request headers) that match a request the application will later make to a trusted origin (e.g., a JWKS endpoint path like /.well-known/jwks.json).
4. Trigger cache population: Cause the application to make a request to the attacker-controlled origin so the malicious response is stored in the shared cache under the empty-origin key.
5. Trigger the victim request: Cause the application to make a request to the trusted origin with the same method, path, and headers. Because the cache key omits the origin, the attacker's cached response is returned instead of contacting the trusted origin.
6. Achieve authentication bypass: If the poisoned response is a JWKS document, the application will use the attacker's public key to validate JWTs. The attacker then signs a JWT with their own private key, which the application accepts as belonging to the trusted issuer, granting unauthorized access (GitHub Advisory).

• Logs: Application logs showing successful JWT validation or authentication events where the JWKS or token-issuer endpoint was not contacted at the expected trusted origin; cache hit logs for requests to trusted origins that should not have been cached.
• Network: Absence of outbound HTTP requests to the trusted origin (e.g., JWKS endpoint) during authentication flows that normally require them, indicating a cache hit from a different origin's response.
• Application Behavior: Unexpected acceptance of tokens signed by unknown or attacker-controlled keys; authorization decisions based on claims from issuers that were never contacted during the session.
• Cache State: Shared undici cache store containing entries with an empty or missing origin field, or entries whose stored response origin does not match the request's intended destination (GitHub Advisory).

Upgrade to undici v8.10.2 or later, which fixes the regression by including the destination origin in cache and deduplication keys. As a workaround for deployments that cannot immediately upgrade, use a separate cache store and a separate interceptor instance for each upstream origin — do not share interceptors.cache() or interceptors.deduplicate() state across origins. Applications already using an Agent (which carries the origin in its dispatch options) are not affected and require no changes (GitHub Advisory).

The advisory was published by mcollina (a Node.js core maintainer) on the undici GitHub repository, with nikolakojic-rasit credited as the reporter and UlisesGascon as the remediation reviewer. Red Hat tracked the issue via Bugzilla (bug #2528717) and published a CVE advisory, indicating downstream Linux distribution impact is being assessed. No significant broader media coverage or social media discussion was observed at the time of disclosure (GitHub Advisory, Red Hat CVE).