Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2026-10601

Path traversal in the Tempo and Loki data source plugins

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana OSS

Default version status: unaffected

  • 11.6.0 to ≤ 11.6.14affected
  • 12.2.0 to ≤ 12.2.8affected
  • 12.3.0 to ≤ 12.3.6affected
  • 12.4.0 to ≤ 12.4.3affected
  • 13.0.0 to ≤ 13.0.1affected

References