CVE-2026-11769 Operator - Namespaced User Path Traversal

What is CVE-2026-11769?

CVE-2026-11769 is a medium-severity path traversal vulnerability in Grafana Operator, published on 13 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.

### Summary

The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.

### Impact

It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.

### Affected versions

All Grafana Operator versions <= 5.23

### Solutions and mitigations

All installations should be upgraded as soon as possible.

As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:

apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny]

### Acknowledgement

We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.

Weakness: CWE-22

Which versions are affected by CVE-2026-11769?

8 open source packages ship an affected version, including github.com/grafana/grafana-operator, github.com/grafana/grafana-operator/v3 and github.com/grafana/grafana-operator/v4. It affects 1 product.

Products include Grafana Grafana Operator.

How do I fix CVE-2026-11769?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-11769 being exploited?

There is no known exploitation of CVE-2026-11769 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fcw4-wwqm-m8cf, GO-2026-5355, MINI-f6q2-xmm5-jcr8, MINI-qmcw-8v3x-fj88.