CVE-2026-11769

Description

A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and information disclosure, specifically enabling the attacker to obtain the Kubernetes service account token of the Grafana Operator manager.

Statement

Red Hat rates this flaw as Moderate severity, in alignment with the upstream Grafana project's assessment. Per Red Hat's severity rating guidelines (https://access.redhat.com/security/updates/classification), Critical impact requires a flaw that could be easily exploited by a remote unauthenticated attacker. This vulnerability requires Kubernetes RBAC privileges to create or modify Dashboard or LibraryPanel custom resources, and therefore cannot be exploited without prior authentication. The direct impact is limited to disclosure of the Grafana Operator manager's service account token through path traversal in jsonnet templating; actual exploitability depends on the specific RBAC configuration and permissions granted to the operator's service account in a given deployment.

Mitigation

To mitigate this issue, implement a ValidatingAdmissionPolicy to prevent the creation or modification of jsonnet-based Dashboard or LibraryPanel resources. This policy restricts the attack surface by disallowing the use of the vulnerable jsonnet templating feature.

Example ValidatingAdmissionPolicy:

yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "prevent-jsonnet-dashboards"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: ["grafana.integreatly.org"]
        apiVersions: ["v1beta1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["grafanadashboards", "grafanalibrarypanels"]
  validations:
    - expression: "!has(object.spec.jsonnetLib)"

Example ValidatingAdmissionPolicyBinding:

yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "prevent-jsonnet-dashboards-clusterwide"
spec:
  policyName: "prevent-jsonnet-dashboards"
  validationActions: [Deny]
Applying these policies will prevent new or updated resources from using the vulnerable jsonnet feature. No service restart is typically required for ValidatingAdmissionPolicies to take effect, but their impact on resource creation/update operations should be monitored.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score6.48.8N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityLowLowN/A
Privileges RequiredLowLowN/A
User InteractionNoneNoneN/A
ScopeChangedUnchangedN/A
ConfidentialityLowHighN/A
Integrity ImpactLowHighN/A
Availability ImpactNoneHighN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat CVSS v3 Score Explanation

Downgraded from Critical (9.6) to Moderate (6.4) to align with upstream assessment. Requires authentication (PR:L), disqualifying Critical per RH severity guidelines.

Understanding the Weakness (CWE)

CWE-22

Integrity,Confidentiality,Availability

Technical Impact: Execute Unauthorized Code or Commands

The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.

Integrity

Technical Impact: Modify Files or Directories

The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.

Confidentiality

Technical Impact: Read Files or Directories

The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.