Critical Security Vulnerability Patched in Grafana Operator 5.24.0

Grafana Labs has issued an urgent security update, releasing version 5.24.0 of its Grafana Operator to patch a critical vulnerability, CVE-2026-11769. This flaw, categorized as a path traversal and privilege escalation issue, posed a substantial risk to Kubernetes environments utilizing the Grafana Operator. The vulnerability stemmed from the Operator's support for loading dashboards and library panels using the Jsonnet data templating language. A malicious actor, with the ability to create or modify Grafana Dashboard or LibraryPanel resources, could exploit this by crafting a Jsonnet expression. This expression would then be evaluated in the context of the Operator manager pod, potentially allowing the attacker to extract the Kubernetes service account token associated with the Grafana Operator manager. Possession of this service account token could grant an attacker elevated privileges, leading to unauthorized access, manipulation, or even complete compromise of the Kubernetes cluster where the Grafana Operator is deployed. The impact of such a breach could be severe, affecting data integrity, confidentiality, and the overall stability of the containerized infrastructure. Grafana Labs has strongly advised all users running affected versions—specifically, Grafana Operator versions 5.23 and earlier—to upgrade their installations to version 5.24.0 as soon as possible. For those unable to upgrade immediately, a workaround involving a ValidatingAdmissionPolicy has been provided. This policy can prevent the creation or modification of Jsonnet-based resources, thereby mitigating the attack vector. The company acknowledged Artem Cherezov for responsibly disclosing the vulnerability, highlighting the importance of community involvement in maintaining software security. This update underscores the continuous need for vigilance and timely patching in complex cloud-native ecosystems.