CVE-2026-10601

Path traversal in the Tempo and Loki data source plugins

View on CVE.org
Published Jun 22, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Analysis

AI-generated

Technical impact

The revised CVE description confirms a path traversal vulnerability in the Tempo and Loki data source plugins. A user with Viewer permissions can craft specially designed requests that reach unintended backend endpoints. Depending on the backend configuration, this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Affected Systems

Any Grafana OSS installation that includes the Tempo and Loki plugins is potentially affected. Grafana versions, so administrators should assume the vulnerability exists in all unpatched instances of these plugins.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity while the EPSS score of less than 1% and absence from the CISA KEV catalog suggest that the vulnerability is not widely exploited at present. The attack requires a legitimate Viewer‑level account that can send API requests through the Grafana interface; by manipulating request parameters a threat actor can reach protected backend endpoints, potentially exfiltrating credentials or initiating state‑changing operations on the Tempo or Loki services.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Grafana OSS to the latest release that includes the fix for10601, which sanitizes user input and restricts access to admin‑only endpoints in the Tempo and Loki plugins
  • If an upgrade is not immediately possible, restrict Viewer roles from accessing or modifying the Tempo and Loki data‑source configurations, or temporarily disable the plugins until the patch is applied
  • Configure a network or application firewall rule to block outbound traffic from Grafana to internal endpoints used by Tempo/Loki unless explicitly permitted, and monitor for suspicious API calls such as Tempo’s /flush or /shutdown and Loki’s CallResource endpoint

Generated by OpenCVE AI on August 2, 2026 at 01:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-9493-h4f5-633x Grafana: Path traversal in the Tempo and Loki data source plugins
History
Type Values Removed Values Added
Weaknesses CWE-200
Type Values Removed Values Added
Title Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access Path traversal in the Tempo and Loki data source plugins
Type Values Removed Values Added
Title Path traversal in the Tempo and Loki data source plugins Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access
Type Values Removed Values Added
Description The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies. A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Title Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access Path traversal in the Tempo and Loki data source plugins
Type Values Removed Values Added
First Time appeared Grafana
Grafana grafana
Vendors & Products Grafana
Grafana grafana
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-200
CWE-22
Type Values Removed Values Added
Description The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.
Title Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}
Earlier changes (4)
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
GRAFANA
Published
Updated
Aug 27, 2026, 5:22 PM
Reserved
Jun 2, 2026, 9:57 AM

View source JSON

Updated
Jun 22, 2026, 3:44 PM

JSON

Status
Modified
Published
Jun 22, 2026, 2:16 PM
Modified
Oct 25, 2026, 11:10 PM

View source JSON

Severity
Moderate
Public date
Jun 22, 2026, 1:18 PM

View source Bugzilla JSON

Updated
Aug 2, 2026, 1:45 AM

JSON