The Grafana Operator supports loading dashboards and library panels via the jsonnet data templating language, which is evaluated in the context of the operator manager pod. This creates a path traversal and privilege escalation vulnerability whereby an attacker with permission to create or modify Dashboard or LibraryPanel resources can extract the Kubernetes service account token of the operator manager pod. This token could potentially be used to escalate privileges within the Kubernetes cluster. The vulnerability affects all Grafana Operator versions up to and including 5.23. Version 5.24.0 includes a critical security fix for this issue. A workaround involves deploying a ValidatingAdmissionPolicy to block jsonnet-based resource creation or modification.

A malicious user with the ability to create or modify Grafana Dashboard or LibraryPanel resources can exploit this vulnerability to obtain the Kubernetes service account token of the Grafana Operator manager pod. This token could allow unauthorized access or privilege escalation within the Kubernetes environment, potentially compromising cluster security.

Upgrade all Grafana Operator installations to version 5.24.0 or later, which contains the official security fix. As a temporary workaround, deploy the provided ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding to deny creation or modification of jsonnet-based dashboards and library panels. This prevents exploitation by blocking the vulnerable resource types until the upgrade can be performed.