EUVD-2026-36641
GHSA-fcw4-wwqm-m8cf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector via Kubernetes API; PR:L for required CRD write RBAC; scope change because operator pod token theft affects the broader cluster.
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.
Summary
The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.
Impact
It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.
Affected versions
All Grafana Operator versions <= 5.23
Solutions and mitigations
All installations should be upgraded as soon as possible.
As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: "prevent-jsonnet-dashboards"
spec:
failurePolicy: Fail matchConstraints: resourceRules:
- apiGroups: ["grafana.integreatly.org"]
apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations:
- expression: "!has(object.spec.jsonnetLib)"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: "prevent-jsonnet-dashboards-clusterwide"
spec:
policyName: "prevent-jsonnet-dashboards" validationActions: [Deny]
Acknowledgement
We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.
AnalysisAI
Privilege escalation in Grafana Operator (all versions ≤ 5.23) allows any user with Kubernetes RBAC permissions to create GrafanaDashboard or GrafanaLibraryPanel resources to steal the Kubernetes service account token of the operator manager pod. The jsonnet templating language, supported via spec.jsonnetLib, is evaluated unsandboxed inside the operator manager pod, enabling a path traversal payload to read sensitive files - including the mounted service account token - and exfiltrate it through the resulting dashboard output. No public exploit is identified at time of analysis, but successful exploitation yields cluster-level privilege escalation, reflected in the vendor-assigned CVSS 4.0 subsequent-system impact of SC:H/SI:H.
Technical ContextAI
The Grafana Operator is a Kubernetes operator (CPE: cpe:2.3:a:grafana:grafana_operator:*:*:*:*:*:*:*:*) that manages Grafana instances via custom resource definitions including GrafanaDashboard and GrafanaLibraryPanel in the grafana.integreatly.org/v1beta1 API group. The operator supports jsonnet - a data templating language - specified in the spec.jsonnetLib field of these CRDs to enable dynamic dashboard generation. Critically, jsonnet evaluation is performed in-process within the operator manager pod rather than in an isolated sandbox. This creates a path traversal condition (conceptually CWE-22, though the reporter lists CWE as N/A) where a crafted jsonnet expression can read arbitrary files from the pod's filesystem, including the Kubernetes service account token typically mounted at /var/run/secrets/kubernetes.io/serviceaccount/token. That token carries the RBAC permissions of the operator's service account, which by design must be elevated to manage cluster-wide Grafana resources.
RemediationAI
The primary fix is to upgrade the Grafana Operator to version 5.24.0, which contains the security patch. All installations should upgrade as soon as possible per vendor guidance. Where immediate upgrade is not feasible, deploy the ValidatingAdmissionPolicy provided in the vendor advisory, which blocks creation or modification of any GrafanaDashboard or GrafanaLibraryPanel resource containing a spec.jsonnetLib field using the CEL expression !has(object.spec.jsonnetLib). The trade-off of this workaround is that all legitimate jsonnet-based dashboard workflows will be blocked until the policy is removed after upgrading. As an additional defensive layer, review and tighten Kubernetes RBAC to restrict which users, service accounts, or namespaces can create or update grafanadashboards and grafanalibrarypanels resources in the grafana.integreatly.org API group - reducing the pool of principals who can reach the vulnerable code path. The full ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding YAML is available in the vendor advisory at https://grafana.com/security/security-advisories/cve-2026-11769.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today