EUVD-2026-36641
GHSA-fcw4-wwqm-m8cf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector via Kubernetes API; PR:L for required CRD write RBAC; scope change because operator pod token theft affects the broader cluster.
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
Lifecycle Timeline
1DescriptionCVE.org
We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.
Summary
The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.
Impact
It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.
Affected versions
All Grafana Operator versions <= 5.23
Solutions and mitigations
All installations should be upgraded as soon as possible.
As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: "prevent-jsonnet-dashboards"
spec:
failurePolicy: Fail matchConstraints: resourceRules:
- apiGroups: ["grafana.integreatly.org"]
apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations:
- expression: "!has(object.spec.jsonnetLib)"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: "prevent-jsonnet-dashboards-clusterwide"
spec:
policyName: "prevent-jsonnet-dashboards" validationActions: [Deny]
Acknowledgement
We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.
AnalysisAI
Privilege escalation in Grafana Operator (all versions ≤ 5.23) allows any user with Kubernetes RBAC permissions to create GrafanaDashboard or GrafanaLibraryPanel resources to steal the Kubernetes service account token of the operator manager pod. The jsonnet templating language, supported via spec.jsonnetLib, is evaluated unsandboxed inside the operator manager pod, enabling a path traversal payload to read sensitive files - including the mounted service account token - and exfiltrate it through the resulting dashboard output. No public exploit is identified at time of analysis, but successful exploitation yields cluster-level privilege escalation, reflected in the vendor-assigned CVSS 4.0 subsequent-system impact of SC:H/SI:H.
Technical ContextAI
The Grafana Operator is a Kubernetes operator (CPE: cpe:2.3:a:grafana:grafana_operator:*:*:*:*:*:*:*:*) that manages Grafana instances via custom resource definitions including GrafanaDashboard and GrafanaLibraryPanel in the grafana.integreatly.org/v1beta1 API group. The operator supports jsonnet - a data templating language - specified in the spec.jsonnetLib field of these CRDs to enable dynamic dashboard generation. Critically, jsonnet evaluation is performed in-process within the operator manager pod rather than in an isolated sandbox. This creates a path traversal condition (conceptually CWE-22, though the reporter lists CWE as N/A) where a crafted jsonnet expression can read arbitrary files from the pod's filesystem, including the Kubernetes service account token typically mounted at /var/run/secrets/kubernetes.io/serviceaccount/token. That token carries the RBAC permissions of the operator's service account, which by design must be elevated to manage cluster-wide Grafana resources.
RemediationAI
The primary fix is to upgrade the Grafana Operator to version 5.24.0, which contains the security patch. All installations should upgrade as soon as possible per vendor guidance. Where immediate upgrade is not feasible, deploy the ValidatingAdmissionPolicy provided in the vendor advisory, which blocks creation or modification of any GrafanaDashboard or GrafanaLibraryPanel resource containing a spec.jsonnetLib field using the CEL expression !has(object.spec.jsonnetLib). The trade-off of this workaround is that all legitimate jsonnet-based dashboard workflows will be blocked until the policy is removed after upgrading. As an additional defensive layer, review and tighten Kubernetes RBAC to restrict which users, service accounts, or namespaces can create or update grafanadashboards and grafanalibrarypanels resources in the grafana.integreatly.org API group - reducing the pool of principals who can reach the vulnerable code path. The full ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding YAML is available in the vendor advisory at https://grafana.com/security/security-advisories/cve-2026-11769.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-22 – Path Traversal
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today