Grafana Operator privilege escalation via path traversal in jsonnetLib

Severity: medium · CVSS 6.4 · Published 2026-06-13

The Grafana Operator, a tool used to manage Grafana instances within Kubernetes clusters, is vulnerable to a security flaw that allows unauthorized access to sensitive credentials. By submitting a specially crafted dashboard configuration, a user with limited permissions can steal the operator's service account token. This token could allow an attacker to gain broad administrative control over the entire Kubernetes cluster, potentially leading to full system compromise or data theft.

Vendors: Go, Grafana Labs.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.4, published 13 June 2026.
Which products and versions are affected?
github.com/grafana/grafana-operator (Go) <= 5.23.0; Grafana Labs Grafana Operator <= 5.23.0.
Is there a fix for This vulnerability?
A patch was published on 2026-06-19: Advisory updated/withdrawn as duplicate; fix available in 5.24.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run github.com/grafana/grafana-operator (Go) or Grafana Labs Grafana Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the Grafana Operator's handling of the jsonnetLib fileName within GrafanaDashboard and GrafanaLibraryPanel resources. Because jsonnet expressions are evaluated in the context of the operator manager pod, an attacker with 'create' or 'update' permissions for these custom resources can exploit the path traversal to read sensitive files. Specifically, this allows the extraction of the Kubernetes service account token belonging to the Grafana Operator manager. This results in a privilege escalation from a namespace-level administrator to a cluster-level administrator. The issue is fixed in version 5.24.0.

Affected products

  • Grafana Labs Grafana Operator <= 5.23.0

Timeline

  • 2026-06-13: disclosed
  • 2026-06-13: advisory
  • 2026-06-19: patched: Advisory updated/withdrawn as duplicate; fix available in 5.24.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.