The Tempo and Loki datasource plugins build backend HTTP requests by directly inserting user-supplied data into URL paths without sanitization. This flaw allows a Viewer‑role user to perform path traversal, exposing administrator‑configured credentials stored in secureJsonData, triggering state‑changing admin endpoints such as /flush and /shutdown on Tempo, and retrieving full HTTP responses from Loki’s CallResource endpoint. Consequently, an attacker with Viewer access can obtain privileged credentials, alter the behavior of backend services, and exfiltrate internal data, compromising confidentiality and integrity.

Any Grafana OSS installation that includes the Tempo and Loki datasource plugins is potentially affected. The advisory does not enumerate specific plugin or Grafana versions, so administrators should verify that their instances are running the patched releases provided by Grafana. If the minor version number is missing, treat the vulnerability as present in all unpatched distributions of these plugins.

The CVSS score of 5.4 indicates moderate severity. EPSS is not provided, and the vulnerability is not listed in CISA KEV, suggesting no widespread or actively exploited incidents are known. The attack requires a legitimate Viewer‑level account that can interact with the Grafana UI; however, because path traversal operates within the backend request context, an attacker can potentially leverage this to exfiltrate confidential settings and perform unintended administrative actions. Given the moderate risk score and lack of documented exploitation, organizations should assess the impact of their current Grafana rollout and act promptly.