Executive brief
The Grafana Operator, a tool used to manage Grafana instances within Kubernetes clusters, is vulnerable to a security flaw that allows unauthorized access to sensitive credentials. By submitting a specially crafted dashboard configuration, a user with limited permissions can steal the operator's service account token. This token could allow an attacker to gain broad administrative control over the entire Kubernetes cluster, potentially leading to full system compromise or data theft.
Technical details
A path traversal vulnerability exists in the Grafana Operator's handling of the jsonnetLib fileName within GrafanaDashboard and GrafanaLibraryPanel resources. Because jsonnet expressions are evaluated in the context of the operator manager pod, an attacker with 'create' or 'update' permissions for these custom resources can exploit the path traversal to read sensitive files. Specifically, this allows the extraction of the Kubernetes service account token belonging to the Grafana Operator manager. This results in a privilege escalation from a namespace-level administrator to a cluster-level administrator. The issue is fixed in version 5.24.0.
Affected products
- Grafana Labs Grafana Operator <= 5.23.0
Timeline
- 2026-06-13: disclosed
- 2026-06-13: advisory
- 2026-06-19: patched: Advisory updated/withdrawn as duplicate; fix available in 5.24.0