---
id: GHSA-v82c-5c2q-hx9g
title: >-
  Duplicate Advisory: Privilege escalation from namespace admin to cluster admin
  via GrafanaDashboard jsonnetLib fileName
summary: >-
  Duplicate Advisory: Privilege escalation from namespace admin to cluster admin
  via GrafanaDashboard jsonnetLib fileName
severity: medium
cwe:
  - CWE-22
vendor: grafana
product: github.com/grafana/grafana-operator
ecosystem: go
affected:
  - github.com/grafana/grafana-operator <= 5.23.0
published: '2026-06-13'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-v82c-5c2q-hx9g'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11769'
  - url: 'https://grafana.com/security/security-advisories/cve-2026-11769'
  - url: 'https://github.com/advisories/GHSA-v82c-5c2q-hx9g'
tags:
  - ghsa
  - go
ingestedAt: '2026-07-07T15:41:58.968Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fcw4-wwqm-m8cf. This link is maintained to preserve external references.

## Original Description
We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.



### Summary



The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.



### Impact



It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.



### Affected versions



All Grafana Operator versions <= 5.23



### Solutions and mitigations



All installations should be upgraded as soon as possible.



As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:



apiVersion: admissionregistration.k8s.io/v1



kind: ValidatingAdmissionPolicy



metadata:

  name: "prevent-jsonnet-dashboards"


spec:

  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: ["grafana.integreatly.org"]
        apiVersions: ["v1beta1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["grafanadashboards", "grafanalibrarypanels"]
  validations:
    - expression: "!has(object.spec.jsonnetLib)"


---



apiVersion: admissionregistration.k8s.io/v1



kind: ValidatingAdmissionPolicyBinding



metadata:

  name: "prevent-jsonnet-dashboards-clusterwide"


spec:

  policyName: "prevent-jsonnet-dashboards"
  validationActions: [Deny]


### Acknowledgement



We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.

## Affected packages

- `github.com/grafana/grafana-operator <= 5.23.0`

## Remediation

Refer to the advisory for the patched release.