CVE-2026-11769

[CVE catalog]

Severity

Medium · CVSS 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Published

Jun 13, 2026, 4:17:41 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.36% · Oct 27, 2026

A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and information disclosure, specifically enabling the attacker to obtain the Kubernetes service account token of the Grafana Operator manager. grafana-operator: Grafana Operator: Privilege escalation and information disclosure via path traversal in jsonnet templating. Red Hat rates this flaw as Moderate severity, in alignment with the upstream Grafana project's assessment. Per Red Hat's severity rating guidelines (https://access.redhat.com/security/updates/classification), Critical impact requires a flaw that could be easily exploited by a remote unauthenticated attacker. This vulnerability requires Kubernetes RBAC privileges to create or modify Dashboard or LibraryPanel custom resources, and therefore cannot be exploited without prior authentication. The direct impact is limited to disclosure of the Grafana Operator manager's service account token through path traversal in jsonnet templating; actual exploitability depends on the specific RBAC configuration and permissions granted to the operator's service account in a given deployment. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.