CVE-2026-11769: Vulnerability in Grafana Grafana Operator
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affected versions All Grafana Operator versions <= 5.23 ### Solutions and mitigations All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny] ### Acknowledgement We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.
AI Analysis
Technical Summary
The Grafana Operator supports loading dashboards and library panels using the jsonnet data templating language, which is evaluated in the context of the operator manager pod. This creates a path traversal and privilege escalation vulnerability (CWE-22) that allows a malicious user with permission to create or modify Dashboard or LibraryPanel resources to obtain the Kubernetes service account token of the Grafana Operator manager. This token could potentially be used to escalate privileges within the Kubernetes environment. The vulnerability affects all Grafana Operator versions up to and including 5.23. The issue is addressed in Grafana Operator version 5.24.0. As a workaround, a Kubernetes ValidatingAdmissionPolicy can be deployed to prevent creation or modification of jsonnet-based resources, mitigating the risk until upgrade is possible.
Potential Impact
A malicious user who can create or modify Dashboard or LibraryPanel resources in Grafana Operator versions <= 5.23 can exploit this vulnerability to obtain the Kubernetes service account token of the Grafana Operator manager pod. This token exposure can lead to privilege escalation within the Kubernetes cluster, potentially compromising cluster security. The CVSS 4.0 base score is 6.4 (medium severity), indicating a significant but not critical risk.
Mitigation Recommendations
Upgrade all Grafana Operator installations to version 5.24.0 or later, which includes a fix for this vulnerability. If immediate upgrade is not possible, deploy the provided ValidatingAdmissionPolicy to prevent creation or modification of jsonnet-based Dashboard or LibraryPanel resources, effectively blocking exploitation of this vulnerability. This policy denies operations on resources containing jsonnet expressions, mitigating the risk until the patch can be applied.
CVE-2026-11769: Vulnerability in Grafana Grafana Operator
Description
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affected versions All Grafana Operator versions <= 5.23 ### Solutions and mitigations All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny] ### Acknowledgement We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.
CVSS v4.0
Score 6.4medium
Affected software
pkg:github/grafana/grafana-operatorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Grafana Operator supports loading dashboards and library panels using the jsonnet data templating language, which is evaluated in the context of the operator manager pod. This creates a path traversal and privilege escalation vulnerability (CWE-22) that allows a malicious user with permission to create or modify Dashboard or LibraryPanel resources to obtain the Kubernetes service account token of the Grafana Operator manager. This token could potentially be used to escalate privileges within the Kubernetes environment. The vulnerability affects all Grafana Operator versions up to and including 5.23. The issue is addressed in Grafana Operator version 5.24.0. As a workaround, a Kubernetes ValidatingAdmissionPolicy can be deployed to prevent creation or modification of jsonnet-based resources, mitigating the risk until upgrade is possible.
Potential Impact
A malicious user who can create or modify Dashboard or LibraryPanel resources in Grafana Operator versions <= 5.23 can exploit this vulnerability to obtain the Kubernetes service account token of the Grafana Operator manager pod. This token exposure can lead to privilege escalation within the Kubernetes cluster, potentially compromising cluster security. The CVSS 4.0 base score is 6.4 (medium severity), indicating a significant but not critical risk.
Mitigation Recommendations
Upgrade all Grafana Operator installations to version 5.24.0 or later, which includes a fix for this vulnerability. If immediate upgrade is not possible, deploy the provided ValidatingAdmissionPolicy to prevent creation or modification of jsonnet-based Dashboard or LibraryPanel resources, effectively blocking exploitation of this vulnerability. This policy denies operations on resources containing jsonnet expressions, mitigating the risk until the patch can be applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GRAFANA
- Date Reserved
- 2026-06-09T10:52:06.229Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2ce98ae617e2d83459addd
Added to database: 06/13/2026, 05:24:26 UTC
Last enriched: 07/25/2026, 21:43:08 UTC
Last updated: 07/31/2026, 21:26:44 UTC
Views: 244
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.