GHSA-FCW4-WWQM-M8CF Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

🗓️ 19 Jun 2026 20:51:16Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Grafana Operator up to 5.23 allows path traversal via jsonnetLib to obtain the operator manager service account token; fixed in 5.24.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2026-11769	30 Jun 202616:58	–	circl
CVE	CVE-2026-11769	13 Jun 202604:17	–	cve
Cvelist	CVE-2026-11769 Operator - Namespaced User Path Traversal	13 Jun 202604:17	–	cvelist
EUVD	EUVD-2026-36641	19 Jun 202620:51	–	euvd
Github Security Blog	Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName	19 Jun 202620:51	–	github
Github Security Blog	Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName	13 Jun 202606:30	–	github
NVD	CVE-2026-11769	13 Jun 202606:16	–	nvd
OSV	GHSA-V82C-5C2Q-HX9G Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName	13 Jun 202606:30	–	osv
OSV	GO-2026-5355 Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator	25 Jun 202618:43	–	osv
OSV	MINI-F6Q2-XMM5-JCR8	20 Jun 202616:04	–	osv

Source	Link
github	www.github.com/grafana/grafana-operator/security/advisories/GHSA-fcw4-wwqm-m8cf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-11769
github	www.github.com/grafana/grafana-operator
grafana	www.grafana.com/security/security-advisories/cve-2026-11769

25 Jun 2026 19:56Current

5.9Medium risk

Vulners AI Score5.9

CVSS 46.4

EPSS0.00361