CVE-2026-10601

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2026-10601	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:grafana:grafana:11.6.0:-:*:*:-:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Los plugins de fuente de datos de Tempo y Loki construyen solicitudes HTTP de backend interpolando la entrada proporcionada por el usuario en las rutas URL sin saneamiento, lo que permite el salto de ruta. Un usuario con rol de Visor puede: (1) capturar credenciales de fuente de datos configuradas por el administrador (encabezados personalizados secureJsonData) al saltar a un endpoint controlado por el atacante, (2) invocar endpoints de administrador que cambian el estado en Tempo (por ejemplo, /flush, /shutdown), y (3) exfiltrar datos de servicio internos a través de CallResource de Loki, que devuelve cuerpos completos de respuesta HTTP.

Information

Published : 2026-06-22 14:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-10601

Mitre link : CVE-2026-10601

CVE.ORG link : CVE-2026-10601

JSON object : View

Products Affected

grafana

grafana

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-10601", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10601", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T15:44:03.006985Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@grafana.com", "affectedData": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"status": "affected", "version": "12.2.0", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T14:16:25.167", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-10601", "tags": ["Broken Link"], "source": "security@grafana.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@grafana.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend."}, {"lang": "es", "value": "Los plugins de fuente de datos de Tempo y Loki construyen solicitudes HTTP de backend interpolando la entrada proporcionada por el usuario en las rutas URL sin saneamiento, lo que permite el salto de ruta. Un usuario con rol de Visor puede: (1) capturar credenciales de fuente de datos configuradas por el administrador (encabezados personalizados secureJsonData) al saltar a un endpoint controlado por el atacante, (2) invocar endpoints de administrador que cambian el estado en Tempo (por ejemplo, /flush, /shutdown), y (3) exfiltrar datos de servicio internos a trav\u00e9s de CallResource de Loki, que devuelve cuerpos completos de respuesta HTTP."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:11.6.0:-:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "1C499469-E087-433D-809A-92F454E0D917"}], "operator": "OR"}]}], "sourceIdentifier": "security@grafana.com"}