{"id":"CVE-2026-10601","aliases":["ALPINE-CVE-2026-10601","BIT-grafana-2026-10601","CLSA-2026-1785563141","CLSA-2026-1788279341","EUVD-2026-38242","GHSA-9493-h4f5-633x","GO-2026-6545","RHSA-2026:62527","RHSA-2026:62537","RHSA-2026:64525","RHSA-2026:64585","RHSA-2026:67573","RHSA-2026:67605","RHSA-2026:68143"],"status":"published","title":"Path traversal in the Tempo and Loki data source plugins","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00286,"percentile":0.21354,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-06-22T13:18:31Z","modified":"2026-11-03T06:32:52Z","fixes":[{"ecosystem":"Go","package":"github.com/grafana/grafana","fixed_in":["11.6.15","12.2.9","12.3.7","13.0.2","12.4.4","1.9.2-0.20260616075434-82ef13993059"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["12.4.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["11.6.15","12.2.9","12.3.7","12.4.4","13.0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"loki3.6","fixed_in":["0:3.6.16-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"loki3.6-canary","fixed_in":["0:3.6.16-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"loki3.6-logcli","fixed_in":["0:3.6.16-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"loki3.7","fixed_in":["0:3.7.7-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"loki3.7-canary","fixed_in":["0:3.7.7-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"loki3.7-logcli","fixed_in":["0:3.7.7-0.1.hum1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta1"},{"fixed":"11.6.15"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.2.9"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.3.0"},{"fixed":"12.3.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.4.0"},{"fixed":"12.4.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-0.20260616075434-82ef13993059"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.4-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.6.15"},{"introduced":"12.0.0"},{"fixed":"12.2.9"},{"introduced":"12.3.0"},{"fixed":"12.3.7"},{"introduced":"12.4.0"},{"fixed":"12.4.4"},{"introduced":"13.0.0"},{"fixed":"13.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els15"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els15"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.9-4.el9_2.alma.1.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-beta1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"12.3.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"12.4.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.2-0.20260616075434-82ef13993059"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-beta1+incompatible"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tempo2.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.8-0.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tempo3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-0.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.16-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.6-canary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.16-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.6-logcli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.16-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.7-canary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.7-logcli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.9.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.4.hum1"}]}],"bundled":3}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"grafana","product":"grafana oss"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-10601","tags":["vendor-advisory","Broken Link","web","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10601","tags":["web","advisory"]},{"url":"https://github.com/grafana/grafana/pull/125789","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/d27d2eba9c509d16f214d290436a6ad0bd9c6c01","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/dd5dc51681ff0133ddb2e206c2ea318713aeca16","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/f70d3e480274a5dbd12006338c393f4b05d441ca","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/releases/tag/v11.6.15","tags":["web"]},{"url":"https://github.com/grafana/grafana/releases/tag/v12.2.9","tags":["web"]},{"url":"https://github.com/grafana/grafana/releases/tag/v12.3.7","tags":["web"]},{"url":"https://github.com/grafana/grafana/releases/tag/v12.4.4","tags":["web"]},{"url":"https://github.com/grafana/grafana/releases/tag/v13.0.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9493-h4f5-633x","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-10601","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785563141.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21722","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33381","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788279341.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10601.json","tags":["advisory"]},{"url":"https://github.com/grafana/grafana","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62527","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81092","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10601","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62527.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491359","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10601","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525106","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81092","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81092","tags":["advisory"]},{"url":"https://github.com/mark3labs/mcp-go","tags":["article"]},{"url":"https://github.com/mark3labs/mcp-go/pull/921","tags":["article"]},{"url":"https://github.com/mark3labs/mcp-go/releases/tag/v0.56.0","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/mcp-go-before-0.56.0-missing-host-header-validation-enables-dns-rebinding","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62537","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62537.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:64525","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64525.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:64585","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64585.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67573","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-90771","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9029","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75838","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67573.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9029","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-9029","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75838","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532688","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90771","tags":["advisory"]},{"url":"https://github.com/hapijs/joi","tags":["article"]},{"url":"https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js","tags":["article"]},{"url":"https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","tags":["article"]},{"url":"https://github.com/hapijs/joi/issues/3150","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67605","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-61709","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67605.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61709","tags":["advisory"]},{"url":"https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3","tags":["article"]},{"url":"https://github.com/openfga/openfga/releases/tag/v1.18.1","tags":["article"]},{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68143","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86472","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68143.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86472","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-10601","title":"Path traversal in the Tempo and Loki data source plugins","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","status":"published","published":"2026-06-22T13:18:31.531Z","modified":"2026-08-27T17:22:42.795Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-22","CWE-22"],"updated_at":"2026-11-02T13:40:12.486331Z"}],"euvd":[{"id":"EUVD-2026-38242","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","status":"published","published":"2026-06-22T13:18:31Z","modified":"2026-08-27T17:22:42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-9493-h4f5-633x","title":"Grafana: Path traversal in the Tempo and Loki data source plugins","description":"The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.","status":"published","published":"2026-06-22T15:30:43Z","modified":"2026-09-21T23:03:35Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:19.455935Z"}],"nvd":[{"id":"CVE-2026-10601","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","status":"published","published":"2026-06-22T14:16:25.167Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"ALPINE-CVE-2026-10601","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","status":"published","published":"2026-06-22T14:16:25.167Z","modified":"2026-11-03T06:32:52.415745853Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-10601","title":"Path traversal in the Tempo and Loki data source plugins","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","status":"published","published":"2026-06-22T13:18:31.531Z","modified":"2026-10-28T02:30:25.48764911Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"GHSA-9493-h4f5-633x","title":"Grafana: Path traversal in the Tempo and Loki data source plugins","description":"The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.","status":"published","published":"2026-06-22T15:30:43Z","modified":"2026-09-28T17:10:58.470413066Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"RHSA-2026:62527","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-05T10:17:18Z","modified":"2026-09-22T10:42:44.877267643Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62537","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-06T10:18:08Z","modified":"2026-09-22T10:42:43.636021761Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:64525","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:17:32Z","modified":"2026-09-22T10:32:10.778992632Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:64585","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:17:32Z","modified":"2026-09-22T10:31:46.918607916Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:67573","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:18:44Z","modified":"2026-10-20T10:13:59Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67605","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:18:47Z","modified":"2026-10-20T10:14:02Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68143","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:03Z","modified":"2026-10-16T10:23:23Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"BIT-grafana-2026-10601","title":"Path traversal in the Tempo and Loki data source plugins","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","status":"published","published":"2026-06-26T08:42:32.754Z","modified":"2026-09-28T17:10:58.470413066Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2026-1785563141","title":"grafana: Fix of 10 CVEs","description":"- CVE-2026-21722: clamp public dashboard annotation queries to the dashboard's\n  locked time range when time selection is disabled\n- CVE-2026-10601: reject Loki resource paths that escape /loki/api/v1/ and\n  require Tempo trace ids to be hexadecimal\n- CVE-2026-28380: resolve the snapshot's dashboard by uid so the delete\n  permission check is not skipped\n- CVE-2024-10452: require a matching org (or server admin) to revoke an invite\n- CVE-2026-28379: take the read lock around the managed-stream map lookup to\n  stop a fatal concurrent map read/write crash\n- CVE-2026-28376: bound the Live push request body at 500k\n- CVE-2026-28383: bound the plugin resource request body at 128 MiB\n- CVE-2026-28375: cap testdata scenario data points at 10000\n- CVE-2026-27879: bound the mathexp.Resample upsample length","status":"published","published":"2026-08-01T05:45:59Z","modified":"2026-10-26T09:43:48.309543557Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1788279341","title":"grafana: Fix of 11 CVEs","description":"- CVE-2026-10601: reject path traversal in Loki resource paths and non-hexadecimal Tempo trace IDs\n- CVE-2026-28376: limit Grafana Live push request bodies to 500 KiB\n- CVE-2026-28379: synchronize managed-stream map reads\n- CVE-2026-28383: limit plugin resource request bodies to 128 MiB","status":"published","published":"2026-09-03T15:24:44Z","modified":"2026-10-26T09:30:33.201772188Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"GO-2026-6545","title":"Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana","description":"Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.","status":"published","published":"2026-09-28T16:43:40Z","modified":"2026-09-28T17:10:58.470413066Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}