Description
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Published: 2026-06-22
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Tempo and Loki data‑source plugins for Grafana OSS allow a user with Viewer permissions to craft requests that reach unintended backend endpoints. This flaw can expose stored data‑source credentials, leak internal HTTP responses, or trigger administrative actions on the backend service, thereby compromising confidentiality and integrity of data.

Affected Systems

Any Grafana OSS installation that includes the Tempo and Loki plugins is potentially affected. The advisory does not list specific plugin or Grafana versions, so administrators should assume the vulnerability exists in all unpatched instances of these plugins.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity while the EPSS score of less than 1% and absence from the CISA KEV catalog suggest that the vulnerability is not widely exploited at present. The attack requires a legitimate Viewer‑level account that can send API requests through the Grafana interface; by manipulating request parameters a threat actor can reach protected backend endpoints, potentially exfiltrating credentials or initiating state‑changing operations on the Tempo or Loki services.

Generated by OpenCVE AI on July 13, 2026 at 05:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Grafana OSS to the latest release that includes the fix for CVE‑2026‑10601, which sanitizes user input and restricts access to admin‑only endpoints in the Tempo and Loki plugins
  • If an upgrade is not immediately possible, restrict Viewer roles from accessing or modifying the Tempo and Loki data‑source configurations, or temporarily disable the plugins until the patch is applied
  • Configure a network or application firewall rule to block outbound traffic from Grafana to internal endpoints used by Tempo/Loki unless explicitly permitted, and monitor for suspicious API calls such as Tempo’s /flush or /shutdown and Loki’s CallResource endpoint

Generated by OpenCVE AI on July 13, 2026 at 05:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 12 Jul 2026 03:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Fri, 10 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access Path traversal in the Tempo and Loki data source plugins

Fri, 10 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Title Path traversal in the Tempo and Loki data source plugins Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access

Fri, 10 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies. A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Title Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access Path traversal in the Tempo and Loki data source plugins

Wed, 24 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Grafana
Grafana grafana
Vendors & Products Grafana
Grafana grafana

Tue, 23 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 22 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 22 Jun 2026 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-22

Mon, 22 Jun 2026 13:45:00 +0000

Type Values Removed Values Added
Description The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.
Title Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Grafana Grafana
cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-07-10T18:44:38.226Z

Reserved: 2026-06-02T09:57:26.570Z

Link: CVE-2026-10601

cve-icon Vulnrichment

Updated: 2026-06-22T15:44:10.844Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-22T13:18:31Z

Links: CVE-2026-10601 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-13T06:00:04Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')