---
id: CVE-2026-11769
title: >-
  Grafana Operator: Privilege escalation from namespace admin to cluster admin
  via GrafanaDashboard jsonnetLib fileName
summary: >-
  Grafana Operator: Privilege escalation from namespace admin to cluster admin
  via GrafanaDashboard jsonnetLib fileName
severity: medium
cwe:
  - CWE-22
  - CWE-200
vendor: grafana
product: github.com/grafana/grafana-operator/v5
ecosystem: go
affected:
  - github.com/grafana/grafana-operator/v5 <= 5.23.0
  - github.com/grafana/grafana-operator <= 2.0.0
patched:
  - github.com/grafana/grafana-operator/v5 5.24.0
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-fcw4-wwqm-m8cf'
references:
  - url: >-
      https://github.com/grafana/grafana-operator/security/advisories/GHSA-fcw4-wwqm-m8cf
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11769'
  - url: 'https://grafana.com/security/security-advisories/cve-2026-11769'
  - url: 'https://github.com/advisories/GHSA-fcw4-wwqm-m8cf'
tags:
  - ghsa
  - go
epss: 0.00361
epssPercentile: 0.27331
ingestedAt: '2026-06-22T13:35:24.382Z'
---

## Overview

We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.


### Summary

The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.
### Impact

It is possible for a malicious user who can create `Dashboard` or `LibraryPanel` resources for a `Grafana` instance to obtain the Kubernetes service account token of the Grafana Operator manager.

### Affected versions

All Grafana Operator versions <= 5.23

### Solutions and mitigations

All installations should be upgraded as soon as possible.

As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:
```
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "prevent-jsonnet-dashboards"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: ["grafana.integreatly.org"]
        apiVersions: ["v1beta1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["grafanadashboards", "grafanalibrarypanels"]
  validations:
    - expression: "!has(object.spec.jsonnetLib)"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "prevent-jsonnet-dashboards-clusterwide"
spec:
  policyName: "prevent-jsonnet-dashboards"
  validationActions: [Deny]
```


### Acknowledgement

We would like to thank [Artem Cherezov](https://github.com/cherez0ff) for responsibly disclosing the vulnerability.

## Affected packages

- `github.com/grafana/grafana-operator/v5 <= 5.23.0`
- `github.com/grafana/grafana-operator <= 2.0.0`

## Remediation

Upgrade to a patched release:

- `github.com/grafana/grafana-operator/v5 5.24.0`