Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

🗓️ 19 Jun 2026 20:51:16Reported by GitHub Advisory DatabaseType

Grafana 5.24 fixes path traversal privilege escalation via jsonnet libraries exposing manager token.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2026-11769	30 Jun 202616:58	–	circl
CVE	CVE-2026-11769	13 Jun 202604:17	–	cve
Cvelist	CVE-2026-11769 Operator - Namespaced User Path Traversal	13 Jun 202604:17	–	cvelist
EUVD	EUVD-2026-36641	19 Jun 202620:51	–	euvd
Github Security Blog	Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName	13 Jun 202606:30	–	github
NVD	CVE-2026-11769	13 Jun 202606:16	–	nvd
OSV	GHSA-FCW4-WWQM-M8CF Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName	19 Jun 202620:51	–	osv
OSV	GHSA-V82C-5C2Q-HX9G Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName	13 Jun 202606:30	–	osv
OSV	GO-2026-5355 Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator	25 Jun 202618:43	–	osv
OSV	MINI-F6Q2-XMM5-JCR8	20 Jun 202616:04	–	osv

Vulners

Node

Source	Link
github	www.github.com/grafana/grafana-operator/security/advisories/GHSA-fcw4-wwqm-m8cf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-11769
grafana	www.grafana.com/security/security-advisories/cve-2026-11769
github	www.github.com/advisories/GHSA-fcw4-wwqm-m8cf

19 Jun 2026 20:51Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.8

CVSS 46.4

EPSS0.0032

SSVC