{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11769", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-06-09T10:52:06.229Z", "datePublished": "2026-06-13T04:17:41.099Z", "dateUpdated": "2026-07-13T13:27:23.945Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-07-13T13:27:23.945Z"}, "datePublic": "2026-07-09T11:17:29.029Z", "title": "Operator - Namespaced User Path Traversal", "descriptions": [{"lang": "en", "value": "We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n### Summary\n\nThe Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n### Impact\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n### Affected versions\n\nAll Grafana Operator versions <= 5.23\n\n### Solutions and mitigations\n\nAll installations should be upgraded as soon as possible.\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n name: \"prevent-jsonnet-dashboards\"\nspec:\n failurePolicy: Fail\n matchConstraints:\n resourceRules:\n - apiGroups: [\"grafana.integreatly.org\"]\n apiVersions: [\"v1beta1\"]\n operations: [\"CREATE\", \"UPDATE\"]\n resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n validations:\n - expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n name: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\n policyName: \"prevent-jsonnet-dashboards\"\n validationActions: [Deny]\n\n\n\n### Acknowledgement\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability."}], "affected": [{"vendor": "Grafana", "product": "Grafana Operator", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "5.23.0"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-11769", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}}], "credits": [{"lang": "en", "value": "cherez0ff", "type": "finder"}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T17:24:16.248300Z", "id": "CVE-2026-11769", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T12:01:19.738Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11769", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:24:16.248300Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T17:24:26.320Z"}}], "cna": {"title": "Operator - Namespaced User Path Traversal", "source": {"discovery": "BUG_BOUNTY"}, "credits": [{"lang": "en", "type": "finder", "value": "cherez0ff"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}}], "affected": [{"vendor": "Grafana", "product": "Grafana Operator", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.23.0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-09T11:17:29.029Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-11769", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n### Summary\n\nThe Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n### Impact\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n### Affected versions\n\nAll Grafana Operator versions <= 5.23\n\n### Solutions and mitigations\n\nAll installations should be upgraded as soon as possible.\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n name: \"prevent-jsonnet-dashboards\"\nspec:\n failurePolicy: Fail\n matchConstraints:\n resourceRules:\n - apiGroups: [\"grafana.integreatly.org\"]\n apiVersions: [\"v1beta1\"]\n operations: [\"CREATE\", \"UPDATE\"]\n resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n validations:\n - expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n name: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\n policyName: \"prevent-jsonnet-dashboards\"\n validationActions: [Deny]\n\n\n\n### Acknowledgement\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-07-10T18:44:50.920Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11769", "state": "PUBLISHED", "dateUpdated": "2026-07-10T18:44:50.920Z", "dateReserved": "2026-06-09T10:52:06.229Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-06-13T04:17:41.099Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n\n### Summary\n\n\n\nThe Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n\n### Impact\n\n\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n\n\n### Affected versions\n\n\n\nAll Grafana Operator versions <= 5.23\n\n\n\n### Solutions and mitigations\n\n\n\nAll installations should be upgraded as soon as possible.\n\n\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\n\n\napiVersion: admissionregistration.k8s.io/v1\n\n\n\nkind: ValidatingAdmissionPolicy\n\n\n\nmetadata:\n\n name: \"prevent-jsonnet-dashboards\"\n\n\nspec:\n\n failurePolicy: Fail\n matchConstraints:\n resourceRules:\n - apiGroups: [\"grafana.integreatly.org\"]\n apiVersions: [\"v1beta1\"]\n operations: [\"CREATE\", \"UPDATE\"]\n resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n validations:\n - expression: \"!has(object.spec.jsonnetLib)\"\n\n\n---\n\n\n\napiVersion: admissionregistration.k8s.io/v1\n\n\n\nkind: ValidatingAdmissionPolicyBinding\n\n\n\nmetadata:\n\n name: \"prevent-jsonnet-dashboards-clusterwide\"\n\n\nspec:\n\n policyName: \"prevent-jsonnet-dashboards\"\n validationActions: [Deny]\n\n\n### Acknowledgement\n\n\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability."}], "id": "CVE-2026-11769", "lastModified": "2026-06-16T15:42:57.150", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@grafana.com", "type": "Secondary"}]}, "published": "2026-06-13T06:16:14.380", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-11769"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana-operator: Grafana Operator: Privilege escalation and information disclosure via path traversal in jsonnet templating.", "id": "2488673", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488673"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n### Summary\nThe Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n### Impact\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n### Affected versions\nAll Grafana Operator versions <= 5.23\n### Solutions and mitigations\nAll installations should be upgraded as soon as possible.\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\nname: \"prevent-jsonnet-dashboards\"\nspec:\nfailurePolicy: Fail\nmatchConstraints:\nresourceRules:\n- apiGroups: [\"grafana.integreatly.org\"]\napiVersions: [\"v1beta1\"]\noperations: [\"CREATE\", \"UPDATE\"]\nresources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\nvalidations:\n- expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\nname: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\npolicyName: \"prevent-jsonnet-dashboards\"\nvalidationActions: [Deny]\n### Acknowledgement\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability.", "A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and information disclosure, specifically enabling the attacker to obtain the Kubernetes service account token of the Grafana Operator manager."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, implement a ValidatingAdmissionPolicy to prevent the creation or modification of jsonnet-based Dashboard or LibraryPanel resources. This policy restricts the attack surface by disallowing the use of the vulnerable jsonnet templating feature.\nExample ValidatingAdmissionPolicy:\n```yaml\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\nname: \"prevent-jsonnet-dashboards\"\nspec:\nfailurePolicy: Fail\nmatchConstraints:\nresourceRules:\n- apiGroups: [\"grafana.integreatly.org\"]\napiVersions: [\"v1beta1\"]\noperations: [\"CREATE\", \"UPDATE\"]\nresources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\nvalidations:\n- expression: \"!has(object.spec.jsonnetLib)\"\n```\nExample ValidatingAdmissionPolicyBinding:\n```yaml\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\nname: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\npolicyName: \"prevent-jsonnet-dashboards\"\nvalidationActions: [Deny]\n```\nApplying these policies will prevent new or updated resources from using the vulnerable jsonnet feature. No service restart is typically required for ValidatingAdmissionPolicies to take effect, but their impact on resource creation/update operations should be monitored."}, "name": "CVE-2026-11769", "package_state": [{"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp2/3scale-operator-bundle", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp2/3scale-rhel7-operator", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp2/3scale-rhel9-operator", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3", "fix_state": "Not affected", "package_name": "rhosdt/tempo-rhel9-operator", "product_name": "Red Hat OpenShift distributed tracing 3"}], "public_date": "2026-06-13T04:17:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-11769\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-11769\nhttps://grafana.com/security/security-advisories/cve-2026-11769"], "statement": "Red Hat rates this flaw as Moderate severity, in alignment with the upstream Grafana project's assessment. Per Red Hat's severity rating guidelines (https://access.redhat.com/security/updates/classification), Critical impact requires a flaw that could be easily exploited by a remote unauthenticated attacker. This vulnerability requires Kubernetes RBAC privileges to create or modify Dashboard or LibraryPanel custom resources, and therefore cannot be exploited without prior authentication. The direct impact is limited to disclosure of the Grafana Operator manager's service account token through path traversal in jsonnet templating; actual exploitability depends on the specific RBAC configuration and permissions granted to the operator's service account in a given deployment.", "threat_severity": "Moderate"}