CVE-2026-11769: Grafana Operator Path Traversal Flaw

CVE-2026-11769 Overview

CVE-2026-11769 is a path traversal and privilege escalation vulnerability in the Grafana Operator affecting versions <= 5.23. The Grafana Operator supports loading dashboards and library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod, creating an exploitable trust boundary. A malicious user able to create GrafanaDashboard or GrafanaLibraryPanel resources can leverage this evaluation to obtain the Kubernetes service account token of the Grafana Operator manager pod. This token grants the attacker the operator's cluster permissions, enabling lateral movement within the Kubernetes environment. The issue is classified under [CWE-22] Path Traversal.

Critical Impact
An authenticated user with permission to create Grafana custom resources can exfiltrate the Grafana Operator manager's Kubernetes service account token, leading to privilege escalation within the cluster.

Affected Products

Grafana Operator versions <= 5.23
Kubernetes clusters running the Grafana Operator manager pod
Workloads relying on the grafana.integreatly.org/v1beta1 API for grafanadashboards and grafanalibrarypanels

Discovery Timeline

2026-06-13 - CVE-2026-11769 published to NVD
2026-06-17 - Last updated in NVD database
Vulnerability responsibly disclosed by Artem Cherezov

Technical Details for CVE-2026-11769

Vulnerability Analysis

The Grafana Operator reconciles GrafanaDashboard and GrafanaLibraryPanel custom resources. These resources can include a jsonnetLib field carrying jsonnet templating logic. When the operator processes such a resource, it evaluates the jsonnet expression inside the manager pod's process context. The jsonnet evaluator exposes file import semantics that resolve paths relative to the executing process. Because the evaluation runs inside the operator container, the imported paths reach the pod's local filesystem, including the projected service account token at /var/run/secrets/kubernetes.io/serviceaccount/token. The contents of imported files become part of the rendered output, which the operator then writes back into the resource status or downstream Grafana state. A user able to create the resource therefore retrieves arbitrary file contents from the operator pod through the standard Kubernetes API.

Root Cause

The root cause is the lack of sandboxing on jsonnet evaluation. The operator treats user-supplied jsonnet as trusted templating data and grants it filesystem access within the manager pod. Combined with Kubernetes automounting the service account token, the evaluation context exposes high-value secrets to any tenant authorized to create dashboards.

Attack Vector

An attacker with Kubernetes role-based access control (RBAC) permission to create or update grafanadashboards or grafanalibrarypanels resources submits a manifest containing a jsonnetLib definition. The jsonnet payload imports the service account token file from the operator pod's filesystem and emits its contents into the rendered dashboard or panel. The attacker reads the rendered output through the Kubernetes API and reuses the captured token to authenticate as the operator's service account, inheriting its cluster-wide permissions. Refer to the Grafana Security Advisory for upstream technical details.

Detection Methods for CVE-2026-11769

Indicators of Compromise

Creation or modification events for GrafanaDashboard or GrafanaLibraryPanel resources containing a populated spec.jsonnetLib field from unexpected service accounts or namespaces.
Rendered dashboard or panel content that includes base64 or JWT-like strings consistent with Kubernetes service account tokens.
Kubernetes API requests authenticated with the Grafana Operator manager service account originating from outside the operator pod's network identity.

Detection Strategies

Audit Kubernetes API server logs for CREATE and UPDATE verbs on grafana.integreatly.org/v1beta1 resources, filtering for objects containing the jsonnetLib key.
Correlate operator pod filesystem reads of /var/run/secrets/kubernetes.io/serviceaccount/token with concurrent reconciliation activity on user-supplied custom resources.
Hunt for token reuse by comparing the issuing pod identity in TokenReview events with the source IP of subsequent API requests.

Monitoring Recommendations

Enable Kubernetes audit logging at Metadata level or higher for the grafana.integreatly.org API group and forward events to a centralized analytics platform.
Alert on any successful authentication using the Grafana Operator service account from network namespaces other than the operator pod.
Track changes to ValidatingAdmissionPolicy resources that govern Grafana custom resource validation to detect tampering with mitigations.

How to Mitigate CVE-2026-11769

Immediate Actions Required

Upgrade the Grafana Operator to version 5.24.0 or later across all clusters.
Rotate the Grafana Operator manager service account token after upgrading by deleting the associated secret or restarting the pod with token projection.
Review RBAC bindings that allow tenants to create grafanadashboards and grafanalibrarypanels and remove unnecessary grants.
Inspect historical audit logs for prior submission of jsonnet-based resources by untrusted principals.

Patch Information

Grafana released version 5.24.0 of the Grafana Operator, which contains the fix for CVE-2026-11769. All installations running version 5.23 or earlier must upgrade. Full details are published in the Grafana Security Advisory.

Workarounds

Apply a ValidatingAdmissionPolicy that rejects creation or modification of grafanadashboards and grafanalibrarypanels resources containing a jsonnetLib field.
Restrict RBAC permissions on the affected custom resources to trusted administrators until the upgrade is complete.
Disable automatic service account token mounting on the operator pod where operationally feasible.

bash

# ValidatingAdmissionPolicy to block jsonnet-based Grafana resources
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "prevent-jsonnet-dashboards"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: ["grafana.integreatly.org"]
        apiVersions: ["v1beta1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["grafanadashboards", "grafanalibrarypanels"]
  validations:
    - expression: "!has(object.spec.jsonnetLib)"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "prevent-jsonnet-dashboards-clusterwide"
spec:
  policyName: "prevent-jsonnet-dashboards"
  validationActions: [Deny]