CVE-2026-11769

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11769", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-06-09T10:52:06.229Z", "datePublished": "2026-06-13T04:17:41.099Z", "dateUpdated": "2026-08-27T17:22:27.041Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:27.041Z"}, "datePublic": "2026-07-09T11:17:29.029Z", "title": "Operator - Namespaced User Path Traversal", "descriptions": [{"lang": "en", "value": "We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n### Summary\n\nThe Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n### Impact\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n### Affected versions\n\nAll Grafana Operator versions <= 5.23\n\n### Solutions and mitigations\n\nAll installations should be upgraded as soon as possible.\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n name: \"prevent-jsonnet-dashboards\"\nspec:\n failurePolicy: Fail\n matchConstraints:\n resourceRules:\n - apiGroups: [\"grafana.integreatly.org\"]\n apiVersions: [\"v1beta1\"]\n operations: [\"CREATE\", \"UPDATE\"]\n resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n validations:\n - expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n name: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\n policyName: \"prevent-jsonnet-dashboards\"\n validationActions: [Deny]\n\n\n\n### Acknowledgement\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability."}], "affected": [{"vendor": "Grafana", "product": "Grafana Operator", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "5.23.0"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-11769", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}}], "credits": [{"lang": "en", "value": "cherez0ff", "type": "finder"}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T17:24:16.248300Z", "id": "CVE-2026-11769", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T12:01:19.738Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11769", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:24:16.248300Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T17:24:26.320Z"}}], "cna": {"title": "Operator - Namespaced User Path Traversal", "source": {"discovery": "BUG_BOUNTY"}, "credits": [{"lang": "en", "type": "finder", "value": "cherez0ff"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}}], "affected": [{"vendor": "Grafana", "product": "Grafana Operator", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.23.0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-09T11:17:29.029Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-11769", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n### Summary\n\nThe Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n### Impact\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n### Affected versions\n\nAll Grafana Operator versions <= 5.23\n\n### Solutions and mitigations\n\nAll installations should be upgraded as soon as possible.\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n name: \"prevent-jsonnet-dashboards\"\nspec:\n failurePolicy: Fail\n matchConstraints:\n resourceRules:\n - apiGroups: [\"grafana.integreatly.org\"]\n apiVersions: [\"v1beta1\"]\n operations: [\"CREATE\", \"UPDATE\"]\n resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n validations:\n - expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n name: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\n policyName: \"prevent-jsonnet-dashboards\"\n validationActions: [Deny]\n\n\n\n### Acknowledgement\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:27.041Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11769", "state": "PUBLISHED", "dateUpdated": "2026-08-27T17:22:27.041Z", "dateReserved": "2026-06-09T10:52:06.229Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-06-13T04:17:41.099Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Operator", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "5.23.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana_operator:*:*:*:*:*:*:*:*", "matchCriteriaId": "A03C27FE-3E61-4442-9AC7-C9A7B0E30825", "versionEndExcluding": "5.24.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n### Summary\n\nThe Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n### Impact\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n### Affected versions\n\nAll Grafana Operator versions <= 5.23\n\n### Solutions and mitigations\n\nAll installations should be upgraded as soon as possible.\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n name: \"prevent-jsonnet-dashboards\"\nspec:\n failurePolicy: Fail\n matchConstraints:\n resourceRules:\n - apiGroups: [\"grafana.integreatly.org\"]\n apiVersions: [\"v1beta1\"]\n operations: [\"CREATE\", \"UPDATE\"]\n resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n validations:\n - expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n name: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\n policyName: \"prevent-jsonnet-dashboards\"\n validationActions: [Deny]\n\n\n\n### Acknowledgement\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability."}, {"lang": "es", "value": "Hemos lanzado la versi\u00f3n 5.24.0 del Operador de Grafana. Este parche incluye una correcci\u00f3n de seguridad de severidad CR\u00cdTICA para una vulnerabilidad de salto de ruta/escalada de privilegios en el Operador de Grafana.\n\n### Resumen\n\nEl Operador de Grafana soporta la carga de paneles de control y paneles de biblioteca usando el lenguaje de plantillas de datos jsonnet. La expresi\u00f3n jsonnet es evaluada en el contexto del pod del gestor del operador.\n\n### Impacto\n\nEs posible que un usuario malicioso que pueda crear recursos de Dashboard o LibraryPanel para una instancia de Grafana obtenga el token de cuenta de servicio de Kubernetes del gestor del Operador de Grafana.\n\n### Versiones afectadas\n\nTodas las versiones del Operador de Grafana <= 5.23\n\n### Soluciones y mitigaciones\n\nTodas las instalaciones deber\u00edan ser actualizadas tan pronto como sea posible.\n\nComo soluci\u00f3n alternativa, la siguiente ValidatingAdmissionPolicy previene la creaci\u00f3n o modificaci\u00f3n de recursos basados en jsonnet:\n\napiVersion: admissionregistration.k8s.io/v1\n\nkind: ValidatingAdmissionPolicy\n\nmetadata:\n name: \"prevent-jsonnet-dashboards\"\n\nspec:\n failurePolicy: Fail\n matchConstraints:\n resourceRules:\n - apiGroups: [\"grafana.integreatly.org\"]\n apiVersions: [\"v1beta1\"]\n operations: [\"CREATE\", \"UPDATE\"]\n resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n validations:\n - expression: \"!has(object.spec.jsonnetLib)\"\n\n---\n\napiVersion: admissionregistration.k8s.io/v1\n\nkind: ValidatingAdmissionPolicyBinding\n\nmetadata:\n name: \"prevent-jsonnet-dashboards-clusterwide\"\n\nspec:\n policyName: \"prevent-jsonnet-dashboards\"\n validationActions: [Deny]\n\n### Agradecimiento\n\nNos gustar\u00eda agradecer a Artem Cherezov por divulgar responsablemente la vulnerabilidad."}], "id": "CVE-2026-11769", "lastModified": "2026-07-23T09:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11769", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T17:24:16.248300Z", "version": "2.0.3"}}]}, "published": "2026-06-13T06:16:14.380", "references": [{"source": "security@grafana.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-11769"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana-operator: Grafana Operator: Privilege escalation and information disclosure via path traversal in jsonnet templating.", "id": "2488673", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488673"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n### Summary\nThe Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n### Impact\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n### Affected versions\nAll Grafana Operator versions <= 5.23\n### Solutions and mitigations\nAll installations should be upgraded as soon as possible.\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\nname: \"prevent-jsonnet-dashboards\"\nspec:\nfailurePolicy: Fail\nmatchConstraints:\nresourceRules:\n- apiGroups: [\"grafana.integreatly.org\"]\napiVersions: [\"v1beta1\"]\noperations: [\"CREATE\", \"UPDATE\"]\nresources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\nvalidations:\n- expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\nname: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\npolicyName: \"prevent-jsonnet-dashboards\"\nvalidationActions: [Deny]\n### Acknowledgement\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability.", "A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and information disclosure, specifically enabling the attacker to obtain the Kubernetes service account token of the Grafana Operator manager."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, implement a ValidatingAdmissionPolicy to prevent the creation or modification of jsonnet-based Dashboard or LibraryPanel resources. This policy restricts the attack surface by disallowing the use of the vulnerable jsonnet templating feature.\nExample ValidatingAdmissionPolicy:\n```yaml\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\nname: \"prevent-jsonnet-dashboards\"\nspec:\nfailurePolicy: Fail\nmatchConstraints:\nresourceRules:\n- apiGroups: [\"grafana.integreatly.org\"]\napiVersions: [\"v1beta1\"]\noperations: [\"CREATE\", \"UPDATE\"]\nresources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\nvalidations:\n- expression: \"!has(object.spec.jsonnetLib)\"\n```\nExample ValidatingAdmissionPolicyBinding:\n```yaml\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\nname: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\npolicyName: \"prevent-jsonnet-dashboards\"\nvalidationActions: [Deny]\n```\nApplying these policies will prevent new or updated resources from using the vulnerable jsonnet feature. No service restart is typically required for ValidatingAdmissionPolicies to take effect, but their impact on resource creation/update operations should be monitored."}, "name": "CVE-2026-11769", "package_state": [{"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp2/3scale-operator-bundle", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp2/3scale-rhel7-operator", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp2/3scale-rhel9-operator", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3", "fix_state": "Not affected", "package_name": "rhosdt/tempo-rhel9-operator", "product_name": "Red Hat OpenShift distributed tracing 3"}], "public_date": "2026-06-13T04:17:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-11769\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-11769\nhttps://grafana.com/security/security-advisories/cve-2026-11769"], "statement": "Red Hat rates this flaw as Moderate severity, in alignment with the upstream Grafana project's assessment. Per Red Hat's severity rating guidelines (https://access.redhat.com/security/updates/classification), Critical impact requires a flaw that could be easily exploited by a remote unauthenticated attacker. This vulnerability requires Kubernetes RBAC privileges to create or modify Dashboard or LibraryPanel custom resources, and therefore cannot be exploited without prior authentication. The direct impact is limited to disclosure of the Grafana Operator manager's service account token through path traversal in jsonnet templating; actual exploitability depends on the specific RBAC configuration and permissions granted to the operator's service account in a given deployment.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["OnPrem"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.23.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "grafana_operator", "vendor": "grafana"}], "created": "2026-06-13T06:30:07.667704+00:00", "updated": "2026-07-31T17:15:03.772990+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana_operator"]}