CVE-2026-11769: Grafana Operator Path Traversal & Service Account Token Exposure

Technical summary

CVE-2026-11769 is a path traversal and privilege escalation vulnerability in Grafana Operator stemming from unsafe evaluation of jsonnet expressions used in Dashboard and LibraryPanel resources. When a Dashboard or LibraryPanel resource specifies a jsonnet template via the spec.jsonnetLib field, the Grafana Operator manager pod evaluates this expression directly, executing it within the pod's security context. An attacker with permissions to create or modify these custom resources can craft malicious jsonnet code to access the Kubernetes service account token mounted in the operator pod's filesystem, effectively escalating privileges from resource creator to cluster service account holder. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Business impact

This vulnerability creates a critical supply-chain and privilege escalation risk in Kubernetes clusters running Grafana Operator. Any user—including developers or operators with limited dashboard-creation permissions—can pivot to full Grafana Operator credentials, effectively gaining the operator's cluster-wide permissions. In multi-tenant or shared Kubernetes environments, this enables lateral movement, access to other namespaces' secrets, and potential cluster compromise. Organizations relying on Grafana Operator for observability should treat this as a high-priority upgrade, especially if RBAC policies grant dashboard creation to semi-trusted users.

Affected systems

Grafana Operator versions 5.23 and earlier are affected. The vulnerability requires the operator to be deployed in Kubernetes with jsonnet evaluation enabled (the default). Any cluster running these versions with users capable of creating Dashboard or LibraryPanel resources is at risk, regardless of namespace isolation or RBAC policies that limit dashboard creation.

Exploitability

Exploitability is moderate to high. The attack requires an authenticated user with permission to create or modify Dashboard and LibraryPanel resources—a relatively common permission in shared observability platforms. Network access to the Kubernetes API is required, but in most enterprise environments this is available to developers and operators. No user interaction or special conditions are needed once the malicious resource is created; the operator's automatic evaluation of jsonnet expressions triggers the vulnerability immediately. The CVSS score of 8.8 (HIGH) reflects the combination of low complexity, low privileges required, and high impact across confidentiality, integrity, and availability.

Remediation

Upgrade to Grafana Operator version 5.24.0 or later immediately. As an interim mitigation pending upgrades, deploy the provided ValidatingAdmissionPolicy to prevent creation or modification of Dashboard and LibraryPanel resources containing jsonnet specifications. This policy leverages Kubernetes admission controllers to enforce a blanket denial of jsonnet-based resources cluster-wide, effectively closing the vulnerability vector until the operator is patched.

Patch guidance

Apply the upgrade to version 5.24.0 during a maintenance window. Review the Grafana Operator release notes for any breaking changes or migration steps. In Helm deployments, update the chart version and re-apply; in manual deployments, update the operator image tag and restart the manager pod. Verify the upgrade by checking the operator pod logs and confirming the running version. If immediate upgrade is not possible, immediately implement the ValidatingAdmissionPolicy workaround to prevent jsonnet-based dashboard creation.

Detection guidance

Monitor audit logs and Kubernetes API events for creation or updates to GrafanaDashboard and GrafanaLibraryPanel resources, particularly those containing the spec.jsonnetLib field. Alert on any such activities from unexpected service accounts or users. Review existing Dashboard and LibraryPanel resources in your cluster to identify any already containing jsonnet specifications—these should be audited for tampering. Monitor the Grafana Operator manager pod for unexpected filesystem access patterns or token file reads (e.g., /var/run/secrets/kubernetes.io/serviceaccount/token). Check pod logs for errors or unusual behavior during resource reconciliation.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.8), high exploitability, and the sensitive nature of the Grafana Operator's cluster-wide permissions. The ability to obtain service account tokens represents a direct path to cluster compromise in Kubernetes environments. The wide deployment of Grafana Operator in observability stacks makes this a high-probability attack surface. Organizations should prioritize this upgrade above routine patches but below only active zero-day exploitation scenarios.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-accessible attack vector via Kubernetes API, (2) Low complexity exploitation requiring only valid dashboard creation permissions, (3) Low privileges required—any dashboard creator can exploit it, (4) High confidentiality impact through service account token exposure, (5) High integrity and availability impact through potential cluster-wide resource manipulation. The score does not include CISA KEV status, as this vulnerability is not yet listed on the Known Exploited Vulnerabilities catalog, though this should not diminish urgency given the straightforward exploitation path.

Frequently asked questions