Grafana Operator EUVD-2026-36641

The attacker must hold Kubernetes RBAC permissions to create or update either GrafanaDashboard (grafanadashboards) or GrafanaLibraryPanel (grafanalibrarypanels) resources in the grafana.integreatly.org API group, version v1beta1. This is the sole prerequisite - the jsonnet feature is enabled by default in all affected versions and requires no special operator configuration to be active. Exploitation is not possible without this RBAC grant: a fully unprivileged cluster user cannot trigger the vulnerable code path. The limiting factors are: (1) the attacker must have namespace-scoped or cluster-scoped create/update RBAC on the specified CRD resources, and (2) the Grafana Operator manager pod must be running in the target cluster. External attackers without Kubernetes API access cannot exploit this directly. The CVSS 4.0 vector PR:L confirms that low-privilege authenticated Kubernetes access - not administrative rights - is sufficient.

The vendor-provided CVSS 4.0 score of 6.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N accurately captures the attack architecture: the vulnerable system (the CRD object itself) sustains no direct impact, but the subsequent system - the operator manager pod and the Kubernetes cluster it controls - suffers high confidentiality and integrity compromise. PR:L (low privileges required) reflects the realistic gating factor: only users with RBAC create/update rights on the specific CRD resources can exploit this. In multi-tenant Kubernetes environments where dashboard creation is delegated to developers or tenant users, this is a plausible and serious threat. AC:L and AT:N indicate the exploit requires no special race conditions or chaining, lowering the bar for exploitation once RBAC access is present. No EPSS score is available in the provided data, no CISA KEV listing exists, and no public POC has been identified, so widespread opportunistic exploitation is not currently observed. Real-world priority is HIGH for clusters where CRD write permissions are broadly granted, and MEDIUM for tightly controlled environments. The scope of post-exploitation impact depends on the operator service account's RBAC bindings, which in typical deployments are cluster-scoped.

An attacker who holds Kubernetes RBAC permissions to create GrafanaDashboard resources submits a manifest with a crafted spec.jsonnetLib expression that uses jsonnet's native file import or string manipulation to read /var/run/secrets/kubernetes.io/serviceaccount/token from the operator manager pod's filesystem and embed its contents in the resulting dashboard JSON. The Grafana Operator manager evaluates the jsonnet and stores or surfaces the output, allowing the attacker to retrieve the service account token - then use it to authenticate directly to the Kubernetes API server and perform actions with the operator's elevated cluster-scoped privileges. No public POC is known at time of analysis.