CVE-2026-10601

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10601", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-06-02T09:57:26.570Z", "datePublished": "2026-06-22T13:18:31.531Z", "dateUpdated": "2026-08-27T17:22:42.795Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:42.795Z"}, "datePublic": "2026-06-09T00:00:00.000Z", "title": "Path traversal in the Tempo and Loki data source plugins", "descriptions": [{"lang": "en", "value": "A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend."}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "defaultStatus": "unaffected", "versions": [{"version": "11.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"version": "12.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"version": "12.3.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"version": "12.4.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"version": "13.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.0.1"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-10601", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}}], "credits": [{"lang": "en", "value": "homb (Researcher)", "type": "finder"}], "source": {"discovery": "BUG_BOUNTY"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22", "cweId": "CWE-22", "type": "CWE"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T15:44:03.006985Z", "id": "CVE-2026-10601", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T15:54:19.712Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10601", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T15:44:03.006985Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T15:44:10.844Z"}}], "cna": {"title": "Path traversal in the Tempo and Loki data source plugins", "source": {"discovery": "BUG_BOUNTY"}, "credits": [{"lang": "en", "type": "finder", "value": "homb (Researcher)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"status": "affected", "version": "12.2.0", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-06-09T00:00:00.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-10601", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-26T08:50:35.584Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10601", "state": "PUBLISHED", "dateUpdated": "2026-08-26T08:50:35.584Z", "dateReserved": "2026-06-02T09:57:26.570Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-06-22T13:18:31.531Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.14", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.8", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.6", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.3", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.1", "status": "affected", "version": "13.0.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:11.6.0:-:*:*:-:*:*:*", "matchCriteriaId": "1C499469-E087-433D-809A-92F454E0D917", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend."}, {"lang": "es", "value": "Los plugins de fuente de datos de Tempo y Loki construyen solicitudes HTTP de backend interpolando la entrada proporcionada por el usuario en las rutas URL sin saneamiento, lo que permite el salto de ruta. Un usuario con rol de Visor puede: (1) capturar credenciales de fuente de datos configuradas por el administrador (encabezados personalizados secureJsonData) al saltar a un endpoint controlado por el atacante, (2) invocar endpoints de administrador que cambian el estado en Tempo (por ejemplo, /flush, /shutdown), y (3) exfiltrar datos de servicio internos a trav\u00e9s de CallResource de Loki, que devuelve cuerpos completos de respuesta HTTP."}], "id": "CVE-2026-10601", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@grafana.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10601", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T15:44:03.006985Z", "version": "2.0.3"}}]}, "published": "2026-06-22T14:16:25.167", "references": [{"source": "security@grafana.com", "tags": ["Broken Link"], "url": "https://grafana.com/security/security-advisories/cve-2026-10601"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@grafana.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal", "id": "2491359", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491359"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke state-changing administrative functions on Tempo, or exfiltrate internal service data from Loki."], "name": "CVE-2026-10601", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-5-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-22T13:18:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-10601\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-10601\nhttps://grafana.com/security/security-advisories/cve-2026-10601"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["cloud", "onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "11.6.0"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}], "created": "2026-06-22T14:30:05.337679+00:00", "updated": "2026-08-02T01:45:06.553503+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"]}