Vulnerability-Lookup

CVE-2026-11769 (GCVE-0-2026-11769)

Vulnerability from cvelistv5 – Published: 2026-06-13 04:17 – Updated: 2026-07-24 12:23

Title

Operator - Namespaced User Path Traversal

Summary

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affected versions All Grafana Operator versions <= 5.23 ### Solutions and mitigations All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny] ### Acknowledgement We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.

Severity

6.4 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana Operator	Affected: 0 , ≤ 5.23.0 (semver)

Date Public

2026-07-09 11:17

Credits

cherez0ff

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T17:24:16.248300Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T12:01:19.738Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Operator",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "5.23.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cherez0ff"
        }
      ],
      "datePublic": "2026-07-09T11:17:29.029Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n### Summary\n\nThe Grafana Operator supports loading dashboards \u0026 library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n### Impact\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n### Affected versions\n\nAll Grafana Operator versions \u003c= 5.23\n\n### Solutions and mitigations\n\nAll installations should be upgraded as soon as possible.\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n  name: \"prevent-jsonnet-dashboards\"\nspec:\n  failurePolicy: Fail\n  matchConstraints:\n    resourceRules:\n      - apiGroups: [\"grafana.integreatly.org\"]\n        apiVersions: [\"v1beta1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n  validations:\n    - expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n  name: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\n  policyName: \"prevent-jsonnet-dashboards\"\n  validationActions: [Deny]\n\n\n\n### Acknowledgement\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T12:23:16.710Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-11769"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Operator - Namespaced User Path Traversal",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-11769",
    "datePublished": "2026-06-13T04:17:41.099Z",
    "dateReserved": "2026-06-09T10:52:06.229Z",
    "dateUpdated": "2026-07-24T12:23:16.710Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-11769",
      "date": "2026-07-25",
      "epss": "0.00361",
      "percentile": "0.28722"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-11769\",\"sourceIdentifier\":\"security@grafana.com\",\"published\":\"2026-06-13T06:16:14.380\",\"lastModified\":\"2026-07-23T09:10:00.113\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\\n\\n\\n### Summary\\n\\nThe Grafana Operator supports loading dashboards \u0026 library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\\n\\n\\n### Impact\\n\\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\\n\\n### Affected versions\\n\\nAll Grafana Operator versions \u003c= 5.23\\n\\n### Solutions and mitigations\\n\\nAll installations should be upgraded as soon as possible.\\n\\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\\n\\napiVersion: admissionregistration.k8s.io/v1\\nkind: ValidatingAdmissionPolicy\\nmetadata:\\n  name: \\\"prevent-jsonnet-dashboards\\\"\\nspec:\\n  failurePolicy: Fail\\n  matchConstraints:\\n    resourceRules:\\n      - apiGroups: [\\\"grafana.integreatly.org\\\"]\\n        apiVersions: [\\\"v1beta1\\\"]\\n        operations: [\\\"CREATE\\\", \\\"UPDATE\\\"]\\n        resources: [\\\"grafanadashboards\\\", \\\"grafanalibrarypanels\\\"]\\n  validations:\\n    - expression: \\\"!has(object.spec.jsonnetLib)\\\"\\n---\\napiVersion: admissionregistration.k8s.io/v1\\nkind: ValidatingAdmissionPolicyBinding\\nmetadata:\\n  name: \\\"prevent-jsonnet-dashboards-clusterwide\\\"\\nspec:\\n  policyName: \\\"prevent-jsonnet-dashboards\\\"\\n  validationActions: [Deny]\\n\\n\\n\\n### Acknowledgement\\n\\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability.\"},{\"lang\":\"es\",\"value\":\"Hemos lanzado la versi\u00f3n 5.24.0 del Operador de Grafana. Este parche incluye una correcci\u00f3n de seguridad de severidad CR\u00cdTICA para una vulnerabilidad de salto de ruta/escalada de privilegios en el Operador de Grafana.\\n\\n### Resumen\\n\\nEl Operador de Grafana soporta la carga de paneles de control y paneles de biblioteca usando el lenguaje de plantillas de datos jsonnet. La expresi\u00f3n jsonnet es evaluada en el contexto del pod del gestor del operador.\\n\\n### Impacto\\n\\nEs posible que un usuario malicioso que pueda crear recursos de Dashboard o LibraryPanel para una instancia de Grafana obtenga el token de cuenta de servicio de Kubernetes del gestor del Operador de Grafana.\\n\\n### Versiones afectadas\\n\\nTodas las versiones del Operador de Grafana \u003c= 5.23\\n\\n### Soluciones y mitigaciones\\n\\nTodas las instalaciones deber\u00edan ser actualizadas tan pronto como sea posible.\\n\\nComo soluci\u00f3n alternativa, la siguiente ValidatingAdmissionPolicy previene la creaci\u00f3n o modificaci\u00f3n de recursos basados en jsonnet:\\n\\napiVersion: admissionregistration.k8s.io/v1\\n\\nkind: ValidatingAdmissionPolicy\\n\\nmetadata:\\n  name: \\\"prevent-jsonnet-dashboards\\\"\\n\\nspec:\\n  failurePolicy: Fail\\n  matchConstraints:\\n    resourceRules:\\n      - apiGroups: [\\\"grafana.integreatly.org\\\"]\\n        apiVersions: [\\\"v1beta1\\\"]\\n        operations: [\\\"CREATE\\\", \\\"UPDATE\\\"]\\n        resources: [\\\"grafanadashboards\\\", \\\"grafanalibrarypanels\\\"]\\n  validations:\\n    - expression: \\\"!has(object.spec.jsonnetLib)\\\"\\n\\n---\\n\\napiVersion: admissionregistration.k8s.io/v1\\n\\nkind: ValidatingAdmissionPolicyBinding\\n\\nmetadata:\\n  name: \\\"prevent-jsonnet-dashboards-clusterwide\\\"\\n\\nspec:\\n  policyName: \\\"prevent-jsonnet-dashboards\\\"\\n  validationActions: [Deny]\\n\\n### Agradecimiento\\n\\nNos gustar\u00eda agradecer a Artem Cherezov por divulgar responsablemente la vulnerabilidad.\"}],\"affected\":[{\"source\":\"security@grafana.com\",\"affectedData\":[{\"vendor\":\"Grafana\",\"product\":\"Grafana Operator\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"5.23.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security@grafana.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-15T17:24:16.248300Z\",\"id\":\"CVE-2026-11769\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana_operator:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.24.0\",\"matchCriteriaId\":\"A03C27FE-3E61-4442-9AC7-C9A7B0E30825\"}]}]}],\"references\":[{\"url\":\"https://grafana.com/security/security-advisories/cve-2026-11769\",\"source\":\"security@grafana.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T19:10:45+00:00",
      "cve": "CVE-2026-11769",
      "id": "CVE-2026-11769",
      "initial_release_date": "2026-06-13T04:17:41.099000+00:00",
      "product_status:known_not_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "grafana-operator: Grafana Operator: Privilege escalation and information disclosure via path traversal in jsonnet templating.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11769.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-11769\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-15T17:24:16.248300Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-15T17:24:26.320Z\"}}], \"cna\": {\"title\": \"Operator - Namespaced User Path Traversal\", \"source\": {\"discovery\": \"BUG_BOUNTY\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"cherez0ff\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N\"}}], \"affected\": [{\"vendor\": \"Grafana\", \"product\": \"Grafana Operator\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.23.0\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-07-09T11:17:29.029Z\", \"references\": [{\"url\": \"https://grafana.com/security/security-advisories/cve-2026-11769\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\\n\\n\\n### Summary\\n\\nThe Grafana Operator supports loading dashboards \u0026 library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\\n\\n\\n### Impact\\n\\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\\n\\n### Affected versions\\n\\nAll Grafana Operator versions \u003c= 5.23\\n\\n### Solutions and mitigations\\n\\nAll installations should be upgraded as soon as possible.\\n\\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\\n\\napiVersion: admissionregistration.k8s.io/v1\\nkind: ValidatingAdmissionPolicy\\nmetadata:\\n  name: \\\"prevent-jsonnet-dashboards\\\"\\nspec:\\n  failurePolicy: Fail\\n  matchConstraints:\\n    resourceRules:\\n      - apiGroups: [\\\"grafana.integreatly.org\\\"]\\n        apiVersions: [\\\"v1beta1\\\"]\\n        operations: [\\\"CREATE\\\", \\\"UPDATE\\\"]\\n        resources: [\\\"grafanadashboards\\\", \\\"grafanalibrarypanels\\\"]\\n  validations:\\n    - expression: \\\"!has(object.spec.jsonnetLib)\\\"\\n---\\napiVersion: admissionregistration.k8s.io/v1\\nkind: ValidatingAdmissionPolicyBinding\\nmetadata:\\n  name: \\\"prevent-jsonnet-dashboards-clusterwide\\\"\\nspec:\\n  policyName: \\\"prevent-jsonnet-dashboards\\\"\\n  validationActions: [Deny]\\n\\n\\n\\n### Acknowledgement\\n\\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability.\"}], \"providerMetadata\": {\"orgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"shortName\": \"GRAFANA\", \"dateUpdated\": \"2026-07-24T12:23:16.710Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-11769\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-24T12:23:16.710Z\", \"dateReserved\": \"2026-06-09T10:52:06.229Z\", \"assignerOrgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"datePublished\": \"2026-06-13T04:17:41.099Z\", \"assignerShortName\": \"GRAFANA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-11769

Vulnerability from fkie_nvd - Published: 2026-06-13 06:16 - Updated: 2026-07-23 09:10

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@grafana.com	https://grafana.com/security/security-advisories/cve-2026-11769	Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	grafana	grafana_operator	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Operator",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "5.23.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@grafana.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:grafana:grafana_operator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A03C27FE-3E61-4442-9AC7-C9A7B0E30825",
              "versionEndExcluding": "5.24.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n### Summary\n\nThe Grafana Operator supports loading dashboards \u0026 library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n### Impact\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n### Affected versions\n\nAll Grafana Operator versions \u003c= 5.23\n\n### Solutions and mitigations\n\nAll installations should be upgraded as soon as possible.\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n  name: \"prevent-jsonnet-dashboards\"\nspec:\n  failurePolicy: Fail\n  matchConstraints:\n    resourceRules:\n      - apiGroups: [\"grafana.integreatly.org\"]\n        apiVersions: [\"v1beta1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n  validations:\n    - expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n  name: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\n  policyName: \"prevent-jsonnet-dashboards\"\n  validationActions: [Deny]\n\n\n\n### Acknowledgement\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability."
    },
    {
      "lang": "es",
      "value": "Hemos lanzado la versi\u00f3n 5.24.0 del Operador de Grafana. Este parche incluye una correcci\u00f3n de seguridad de severidad CR\u00cdTICA para una vulnerabilidad de salto de ruta/escalada de privilegios en el Operador de Grafana.\n\n### Resumen\n\nEl Operador de Grafana soporta la carga de paneles de control y paneles de biblioteca usando el lenguaje de plantillas de datos jsonnet. La expresi\u00f3n jsonnet es evaluada en el contexto del pod del gestor del operador.\n\n### Impacto\n\nEs posible que un usuario malicioso que pueda crear recursos de Dashboard o LibraryPanel para una instancia de Grafana obtenga el token de cuenta de servicio de Kubernetes del gestor del Operador de Grafana.\n\n### Versiones afectadas\n\nTodas las versiones del Operador de Grafana \u003c= 5.23\n\n### Soluciones y mitigaciones\n\nTodas las instalaciones deber\u00edan ser actualizadas tan pronto como sea posible.\n\nComo soluci\u00f3n alternativa, la siguiente ValidatingAdmissionPolicy previene la creaci\u00f3n o modificaci\u00f3n de recursos basados en jsonnet:\n\napiVersion: admissionregistration.k8s.io/v1\n\nkind: ValidatingAdmissionPolicy\n\nmetadata:\n  name: \"prevent-jsonnet-dashboards\"\n\nspec:\n  failurePolicy: Fail\n  matchConstraints:\n    resourceRules:\n      - apiGroups: [\"grafana.integreatly.org\"]\n        apiVersions: [\"v1beta1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n  validations:\n    - expression: \"!has(object.spec.jsonnetLib)\"\n\n---\n\napiVersion: admissionregistration.k8s.io/v1\n\nkind: ValidatingAdmissionPolicyBinding\n\nmetadata:\n  name: \"prevent-jsonnet-dashboards-clusterwide\"\n\nspec:\n  policyName: \"prevent-jsonnet-dashboards\"\n  validationActions: [Deny]\n\n### Agradecimiento\n\nNos gustar\u00eda agradecer a Artem Cherezov por divulgar responsablemente la vulnerabilidad."
    }
  ],
  "id": "CVE-2026-11769",
  "lastModified": "2026-07-23T09:10:00.113",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security@grafana.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-11769",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-15T17:24:16.248300Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-13T06:16:14.380",
  "references": [
    {
      "source": "security@grafana.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://grafana.com/security/security-advisories/cve-2026-11769"
    }
  ],
  "sourceIdentifier": "security@grafana.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-FCW4-WWQM-M8CF

Vulnerability from github – Published: 2026-06-19 20:51 – Updated: 2026-06-19 20:51

Summary

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Details

We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.

Summary

The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.

Impact

It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.

Affected versions

All Grafana Operator versions <= 5.23

Solutions and mitigations

All installations should be upgraded as soon as possible.

As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "prevent-jsonnet-dashboards"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: ["grafana.integreatly.org"]
        apiVersions: ["v1beta1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["grafanadashboards", "grafanalibrarypanels"]
  validations:
    - expression: "!has(object.spec.jsonnetLib)"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "prevent-jsonnet-dashboards-clusterwide"
spec:
  policyName: "prevent-jsonnet-dashboards"
  validationActions: [Deny]

Acknowledgement

We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.

Severity

6.4 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.23.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/grafana/grafana-operator/v5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/grafana/grafana-operator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-11769"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T20:51:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n### Summary\n\nThe Grafana Operator supports loading dashboards \u0026 library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n### Impact\n\nIt is possible for a malicious user who can create `Dashboard` or `LibraryPanel` resources for a `Grafana` instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n### Affected versions\n\nAll Grafana Operator versions \u003c= 5.23\n\n### Solutions and mitigations\n\nAll installations should be upgraded as soon as possible.\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n```\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n  name: \"prevent-jsonnet-dashboards\"\nspec:\n  failurePolicy: Fail\n  matchConstraints:\n    resourceRules:\n      - apiGroups: [\"grafana.integreatly.org\"]\n        apiVersions: [\"v1beta1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n  validations:\n    - expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n  name: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\n  policyName: \"prevent-jsonnet-dashboards\"\n  validationActions: [Deny]\n```\n\n\n### Acknowledgement\n\nWe would like to thank [Artem Cherezov](https://github.com/cherez0ff) for responsibly disclosing the vulnerability.",
  "id": "GHSA-fcw4-wwqm-m8cf",
  "modified": "2026-06-19T20:51:16Z",
  "published": "2026-06-19T20:51:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana-operator/security/advisories/GHSA-fcw4-wwqm-m8cf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11769"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grafana/grafana-operator"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2026-11769"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName"
}

GHSA-V82C-5C2Q-HX9G

Vulnerability from github – Published: 2026-06-13 06:30 – Updated: 2026-06-19 20:50

Summary

Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fcw4-wwqm-m8cf. This link is maintained to preserve external references.

Original Description

We have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.

Summary

The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.

Impact

It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.

Affected versions

All Grafana Operator versions <= 5.23

Solutions and mitigations

All installations should be upgraded as soon as possible.

As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:

apiVersion: admissionregistration.k8s.io/v1

kind: ValidatingAdmissionPolicy

metadata:

name: "prevent-jsonnet-dashboards"

spec:

failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)"

apiVersion: admissionregistration.k8s.io/v1

kind: ValidatingAdmissionPolicyBinding

metadata:

name: "prevent-jsonnet-dashboards-clusterwide"

spec:

policyName: "prevent-jsonnet-dashboards" validationActions: [Deny]

Acknowledgement

We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.

Severity

6.4 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/grafana/grafana-operator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T20:50:34Z",
    "nvd_published_at": "2026-06-13T06:16:14Z",
    "severity": "MODERATE"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-fcw4-wwqm-m8cf. This link is maintained to preserve external references.\n\n## Original Description\nWe have released version 5.24.0 of the Grafana Operator. This patch includes a CRITICAL severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n\n### Summary\n\n\n\nThe Grafana Operator supports loading dashboards \u0026 library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n\n### Impact\n\n\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n\n\n### Affected versions\n\n\n\nAll Grafana Operator versions \u003c= 5.23\n\n\n\n### Solutions and mitigations\n\n\n\nAll installations should be upgraded as soon as possible.\n\n\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\n\n\napiVersion: admissionregistration.k8s.io/v1\n\n\n\nkind: ValidatingAdmissionPolicy\n\n\n\nmetadata:\n\n  name: \"prevent-jsonnet-dashboards\"\n\n\nspec:\n\n  failurePolicy: Fail\n  matchConstraints:\n    resourceRules:\n      - apiGroups: [\"grafana.integreatly.org\"]\n        apiVersions: [\"v1beta1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n  validations:\n    - expression: \"!has(object.spec.jsonnetLib)\"\n\n\n---\n\n\n\napiVersion: admissionregistration.k8s.io/v1\n\n\n\nkind: ValidatingAdmissionPolicyBinding\n\n\n\nmetadata:\n\n  name: \"prevent-jsonnet-dashboards-clusterwide\"\n\n\nspec:\n\n  policyName: \"prevent-jsonnet-dashboards\"\n  validationActions: [Deny]\n\n\n### Acknowledgement\n\n\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability.",
  "id": "GHSA-v82c-5c2q-hx9g",
  "modified": "2026-06-19T20:50:34Z",
  "published": "2026-06-13T06:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11769"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2026-11769"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName",
  "withdrawn": "2026-06-19T20:50:34Z"
}

WID-SEC-W-2026-1915

Vulnerability from csaf_certbund - Published: 2026-06-14 22:00 - Updated: 2026-06-16 22:00

Summary

Grafana Operator: Schwachstelle ermöglicht Privilegieneskalation

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Grafana ist eine Analyse- und Visualisierungssoftware.

Angriff: Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Grafana Operator ausnutzen, um seine Privilegien zu erhöhen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-11769

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Grafana Grafana Operator <5.24.0 Grafana / Grafana		Operator <5.24.0

References

4 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/advisories/GHSA-v82c-5c2q-hx9g	external
https://euvd.enisa.europa.eu/enisa/EUVD-2026-36641	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Grafana ist eine Analyse- und Visualisierungssoftware.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Grafana Operator ausnutzen, um seine Privilegien zu erh\u00f6hen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1915 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1915.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1915 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1915"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-v82c-5c2q-hx9g vom 2026-06-14",
        "url": "https://github.com/advisories/GHSA-v82c-5c2q-hx9g"
      },
      {
        "category": "external",
        "summary": "EU Vulnerability Database vom 2026-06-14",
        "url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-36641"
      }
    ],
    "source_lang": "en-US",
    "title": "Grafana Operator: Schwachstelle erm\u00f6glicht Privilegieneskalation",
    "tracking": {
      "current_release_date": "2026-06-16T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-17T06:19:51.115+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1915",
      "initial_release_date": "2026-06-14T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-14T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-16T22:00:00.000+00:00",
          "number": "2",
          "summary": "Pr\u00e4zisierung: Grafana Operator ist betroffen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Operator \u003c5.24.0",
                "product": {
                  "name": "Grafana Grafana Operator \u003c5.24.0",
                  "product_id": "T055352"
                }
              },
              {
                "category": "product_version",
                "name": "Operator 5.24.0",
                "product": {
                  "name": "Grafana Grafana Operator 5.24.0",
                  "product_id": "T055352-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:grafana:grafana:operator__5.24.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Grafana"
          }
        ],
        "category": "vendor",
        "name": "Grafana"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11769",
      "product_status": {
        "known_affected": [
          "T055352"
        ]
      },
      "release_date": "2026-06-14T22:00:00.000+00:00",
      "title": "CVE-2026-11769"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-11769 (GCVE-0-2026-11769)

FKIE_CVE-2026-11769

GHSA-FCW4-WWQM-M8CF

Summary

Impact

Affected versions

Solutions and mitigations

Acknowledgement

GHSA-V82C-5C2Q-HX9G

Duplicate Advisory

Original Description

Summary

Impact

Affected versions

Solutions and mitigations

Acknowledgement

WID-SEC-W-2026-1915

Tags

Sightings

Nomenclature