Every CVE Search/ Get API key

CVE-2026-10601

Path traversal in the Tempo and Loki data source plugins

5.4 MediumFix available

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.29%Unchanged since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.4

Path traversal in the Tempo and Loki data source plugins

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Record
CVE-2026-10601
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-22, CWE-22
Updated
2026-11-02
EUVDEUVD-2026-38242 5.4

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Record
EUVD-2026-38242
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-9493-h4f5-633x 5.4

Grafana: Path traversal in the Tempo and Loki data source plugins

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.

Record
GHSA-9493-h4f5-633x
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
NVD 5.4

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Record
CVE-2026-10601
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2026-10601 4.3

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Record
ALPINE-CVE-2026-10601
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
OSV 5.4

Path traversal in the Tempo and Loki data source plugins

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Record
CVE-2026-10601
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
Show 12 moreShow less
OSVGHSA-9493-h4f5-633x 5.4

Grafana: Path traversal in the Tempo and Loki data source plugins

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.

Record
GHSA-9493-h4f5-633x
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
OSVRHSA-2026:62527 6.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:62527
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62537 6.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:62537
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:64525 5.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:64525
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:64585 5.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:64585
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:67573 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:67573
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67605 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:67605
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:68143 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:68143
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBIT-grafana-2026-10601 No score

Path traversal in the Tempo and Loki data source plugins

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Record
BIT-grafana-2026-10601
Updated
2026-11-02
OSVCLSA-2026-1785563141 No score

grafana: Fix of 10 CVEs

  • CVE-2026-21722: clamp public dashboard annotation queries to the dashboard's locked time range when time selection is disabled
  • CVE-2026-10601: reject Loki resource paths that escape /loki/api/v1/ and require Tempo trace ids to be hexadecimal
  • CVE-2026-28380: resolve the snapshot's dashboard by uid so the delete permission check is not skipped
  • CVE-2024-10452: require a matching org (or server admin) to revoke an invite
  • CVE-2026-28379: take the read lock around the managed-stream map lookup to stop a fatal concurrent map read/write crash
  • CVE-2026-28376: bound the Live push request body at 500k
  • CVE-2026-28383: bound the plugin resource request body at 128 MiB
  • CVE-2026-28375: cap testdata scenario data points at 10000
  • CVE-2026-27879: bound the mathexp.Resample upsample length
Record
CLSA-2026-1785563141
Updated
2026-11-02
OSVCLSA-2026-1788279341 No score

grafana: Fix of 11 CVEs

  • CVE-2026-10601: reject path traversal in Loki resource paths and non-hexadecimal Tempo trace IDs
  • CVE-2026-28376: limit Grafana Live push request bodies to 500 KiB
  • CVE-2026-28379: synchronize managed-stream map reads
  • CVE-2026-28383: limit plugin resource request bodies to 128 MiB
Record
CLSA-2026-1788279341
Updated
2026-11-02
OSVGO-2026-6545 No score

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.

Record
GO-2026-6545
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 2.0.0-beta1 up to 11.6.15
11.6.15
github.com/grafana/grafana
Go
 12.0.0 up to 12.2.9
12.2.9
github.com/grafana/grafana
Go
 12.3.0 up to 12.3.7
12.3.7
github.com/grafana/grafana
Go
 13.0.0 up to 13.0.2
13.0.2
github.com/grafana/grafana
Go
 12.4.0 up to 12.4.4
12.4.4
github.com/grafana/grafana
Go
 before 1.9.2-0.20260616075434-82ef13993059
1.9.2-0.20260616075434-82ef13993059
grafana
Alpine:v3.24
 before 12.4.4-r0
12.4.4-r0
grafana
Bitnami
 before 11.6.15, 12.0.0 up to 12.2.9, 12.3.0 up to 12.3.7, 12.4.0 up to 12.4.4, 13.0.0 up to 13.0.2
11.6.1512.2.912.3.712.4.413.0.2
grafana
TuxCare:AlmaLinux:9.6
 before 10.2.6-15.el9_6.tuxcare.els15
10.2.6-15.el9_6.tuxcare.els15
grafana-selinux
TuxCare:AlmaLinux:9.6
 before 10.2.6-15.el9_6.tuxcare.els15
10.2.6-15.el9_6.tuxcare.els15
Show 19 moreShow less
Affected packages
PackageAffectedFixed
grafana
TuxCare:AlmaLinux:9.2
 before 9.0.9-4.el9_2.alma.1.tuxcare.els21
9.0.9-4.el9_2.alma.1.tuxcare.els21
github.com/grafana/grafana
Go
 2.0.0-beta1 and later None known
github.com/grafana/grafana
Go
 12.0.0 and later None known
github.com/grafana/grafana
Go
 12.3.0 and later None known
github.com/grafana/grafana
Go
 13.0.0 and later None known
github.com/grafana/grafana
Go
 12.4.0 and later None known
github.com/grafana/grafana
Go
 All versions None known
github.com/grafana/grafana
Go
 2.0.0-beta1+incompatible and later None known
tempo2.10
Red Hat:hummingbird:1
 before 0:2.10.8-0.2.hum1
0:2.10.8-0.2.hum1
tempo3.0
Red Hat:hummingbird:1
 before 0:3.0.3-0.2.hum1
0:3.0.3-0.2.hum1
loki3.6
Red Hat:hummingbird:1
 before 0:3.6.16-0.1.hum1
0:3.6.16-0.1.hum1
loki3.6-canary
Red Hat:hummingbird:1
 before 0:3.6.16-0.1.hum1
0:3.6.16-0.1.hum1
loki3.6-logcli
Red Hat:hummingbird:1
 before 0:3.6.16-0.1.hum1
0:3.6.16-0.1.hum1
loki3.7
Red Hat:hummingbird:1
 before 0:3.7.7-0.1.hum1
0:3.7.7-0.1.hum1
loki3.7-canary
Red Hat:hummingbird:1
 before 0:3.7.7-0.1.hum1
0:3.7.7-0.1.hum1
loki3.7-logcli
Red Hat:hummingbird:1
 before 0:3.7.7-0.1.hum1
0:3.7.7-0.1.hum1
grafana13.1
Red Hat:hummingbird:1
 before 0:13.1.3-0.9.hum1
0:13.1.3-0.9.hum1
grafana13.2
Red Hat:hummingbird:1
 before 0:13.2.1-0.4.hum1
0:13.2.1-0.4.hum1
grafana12.4
Red Hat:hummingbird:1
 before 0:12.4.10-0.4.hum1
0:12.4.10-0.4.hum1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-10601 is a medium vulnerability (CVSS 5.4) in Grafana, published June 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in github.com/grafana/grafana 11.6.15.

References

Show 90 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open