GO-2026-4600 vulnerabilities

Vulnerabilities for packages: amazon-k8s-cni-fips, flux-fips, metacontroller, dkron, flux-source-watcher, grafana-operator-fips, victoriametrics, flux-source-controller, victorialogs, flux-operator-fips, librechat, victoriametrics-fips, aws-load-balancer-controller-fips, pluto, grafana-fips,...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, prometheus-alertmanager-fips, crossplane-provider-aws-firehose, certificate-transparency-fips, cosign, kaniko, kubeflow-pipelines, oauth2-proxy, cert-exporter, pulumi-language-yaml, nodetaint, crossplane-provider-aws-memorydb, ferretdb,...

GO-2026-4986 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, prometheus-alertmanager-fips, crossplane-provider-aws-lightsail-fips, volcano-fips, kuma, knative-serving, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-guardduty, prometheus-podman-exporter-fips,...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: nova, flux-image-automation-controller, polaris, podinfo, steampipe, flux-notification-controller, stakater-reloader, flux-source-controller, flux-helm-controller, victoriametrics, flux-image-reflector-controller, go, metacontroller, victoriametrics-cluster,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: nova, flux-image-automation-controller, polaris, podinfo, steampipe, flux-notification-controller, stakater-reloader, flux-source-controller, flux-helm-controller, victoriametrics, flux-image-reflector-controller, go, metacontroller, victoriametrics-cluster,...

GO-2026-4970 vulnerabilities

Vulnerabilities for packages: opentofu, timestamp-authority, kube-fluentd-operator, telegraf, dask-gateway, mattermost, apko, redka, cilium-cli, istio, loki, nerdctl, undock, containerd, kubernetes, falco-no-driver, libnvidia-container, scorecard, zarf, pulumi-language-yaml, grype, pinact, glab,...

CLEANSTART-2026-SG94219 Security fixes in grafana-operator 5.24.0-r1

Package grafana-operator version 5.24.0-r1 fixes 1 vulnerabilities: CVE-2026-39822...

SUSE CVE-2026-11769

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...

CVE-2026-11769

A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and...

GO-2026-5355 Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator...

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templatin...

EUVD-2026-36641

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName...

GHSA-FCW4-WWQM-M8CF Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templatin...

GHSA-V82C-5C2Q-HX9G Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcw4-wwqm-m8cf. This link is maintained to preserve external references. Original Description We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a...

Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcw4-wwqm-m8cf. This link is maintained to preserve external references. Original Description We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a...

CVE-2026-11769

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...

Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure in jsonnetfetcher.go‎ that may expose the Kubernetes service account token of the Grafana Operator manager to users with sufficient privileges to create Dashboard or LibraryPanel resources. This token can be used to...

Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure in jsonnetfetcher.go‎ that may expose the Kubernetes service account token of the Grafana Operator manager to users with sufficient privileges to create Dashboard or LibraryPanel resources. This token can be used to...

CVE-2026-11769

Grafana Operator

CVE-2026-11769 Operator - Namespaced User Path Traversal

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...