CVE-2026-11769: Grafana Operator path traversal and privilege escalation in jsonnet evaluation

Executive brief

The Grafana Operator, which automates the deployment and management of Grafana instances in Kubernetes, is vulnerable to a privilege escalation flaw. An attacker with limited access to create dashboards can exploit this to steal the operator's security credentials. This could allow the attacker to gain full administrative control over the entire Kubernetes cluster, potentially leading to data theft or complete service disruption.

Technical details

A path traversal vulnerability (CWE-22) exists in the Grafana Operator's handling of the `jsonnetLib` field within `GrafanaDashboard` and `GrafanaLibraryPanel` resources. Because Jsonnet expressions are evaluated in the context of the operator manager pod, an attacker with permissions to create or modify these resources can use path traversal to read sensitive files. Specifically, an attacker can extract the Kubernetes service account token of the Grafana Operator manager. Since the operator often runs with high privileges to manage resources across the cluster, this allows for privilege escalation from a namespace-level administrator to a cluster-wide administrator. The issue is fixed in version 5.24.0.

Affected products

• Grafana Grafana Operator <= 5.23.0
• Grafana Grafana Operator <= 2.0.0

Timeline

• 2026-06-16: disclosed
• 2026-06-19: advisory
• 2026-06-19: patched: Fixed in version 5.24.0

References

• https://api.github.com/users/cherez0ff
• https://github.com/cherez0ff
• https://api.github.com/users/cherez0ff/gists%7B/gist_id%7D
• https://api.github.com/users/cherez0ff/repos
• https://avatars.githubusercontent.com/u/63862323?v=4
• https://api.github.com/users/cherez0ff/events%7B/privacy%7D