CVE-2026-11769

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-11769
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affected versions All Grafana Operator versions <= 5.23 ### Solutions and mitigations All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny] ### Acknowledgement We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://grafana.com/security/security-advisories/cve-2026-11769 Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:grafana:grafana_operator:*:*:*:*:*:*:*:*
History

23 Jul 2026, 09:10

Type Values Removed Values Added
Summary
  • (es) Hemos lanzado la versión 5.24.0 del Operador de Grafana. Este parche incluye una corrección de seguridad de severidad CRÍTICA para una vulnerabilidad de salto de ruta/escalada de privilegios en el Operador de Grafana. ### Resumen El Operador de Grafana soporta la carga de paneles de control y paneles de biblioteca usando el lenguaje de plantillas de datos jsonnet. La expresión jsonnet es evaluada en el contexto del pod del gestor del operador. ### Impacto Es posible que un usuario malicioso que pueda crear recursos de Dashboard o LibraryPanel para una instancia de Grafana obtenga el token de cuenta de servicio de Kubernetes del gestor del Operador de Grafana. ### Versiones afectadas Todas las versiones del Operador de Grafana <= 5.23 ### Soluciones y mitigaciones Todas las instalaciones deberían ser actualizadas tan pronto como sea posible. Como solución alternativa, la siguiente ValidatingAdmissionPolicy previene la creación o modificación de recursos basados en jsonnet: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny] ### Agradecimiento Nos gustaría agradecer a Artem Cherezov por divulgar responsablemente la vulnerabilidad.

10 Jul 2026, 16:16

Type Values Removed Values Added
References () https://grafana.com/security/security-advisories/cve-2026-11769 - Vendor Advisory, Mitigation () https://grafana.com/security/security-advisories/cve-2026-11769 - Mitigation, Vendor Advisory
Summary (en) We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affected versions All Grafana Operator versions <= 5.23 ### Solutions and mitigations All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny] ### Acknowledgement We would like to thank Artem Cherezov for responsibly disclosing the vulnerability. (en) We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affected versions All Grafana Operator versions <= 5.23 ### Solutions and mitigations All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny] ### Acknowledgement We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.

30 Jun 2026, 16:38

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CPE cpe:2.3:a:grafana:grafana_operator:*:*:*:*:*:*:*:*
First Time Grafana
Grafana grafana Operator
References () https://grafana.com/security/security-advisories/cve-2026-11769 - () https://grafana.com/security/security-advisories/cve-2026-11769 - Vendor Advisory, Mitigation

16 Jun 2026, 13:16

Type Values Removed Values Added
CWE CWE-22

13 Jun 2026, 06:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-13 06:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-11769

Mitre link : CVE-2026-11769

CVE.ORG link : CVE-2026-11769

JSON object : View

Products Affected

grafana

  • grafana_operator
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')