The Grafana Operator supports loading dashboards and library panels using the jsonnet data templating language, which is evaluated in the context of the operator manager pod. Due to a path traversal and privilege escalation vulnerability, a malicious user with the ability to create or modify Dashboard or LibraryPanel resources can obtain the Kubernetes service account token of the Grafana Operator manager. This token could potentially be used to escalate privileges within the Kubernetes cluster. The vulnerability affects all Grafana Operator versions up to 5.23. The vendor released version 5.24.0 to address this issue. Additionally, a ValidatingAdmissionPolicy can be deployed as a workaround to prevent creation or modification of jsonnet-based resources.

An attacker who can create or modify Grafana Dashboard or LibraryPanel resources can exploit this vulnerability to obtain the Kubernetes service account token of the Grafana Operator manager pod. This token could allow unauthorized access or privilege escalation within the Kubernetes environment where the operator is deployed. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.4, reflecting network attack vector, low attack complexity, no user interaction, and high scope and impact on integrity and availability.

Upgrade all Grafana Operator installations to version 5.24.0 or later, which includes a fix for this vulnerability. As a temporary workaround, deploy the provided ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding to prevent creation or modification of jsonnet-based Dashboard and LibraryPanel resources. This policy denies operations that include the jsonnetLib specification, mitigating the attack vector until the upgrade can be applied.