CVE-2026-10601

Modified Modified - Updated After Analysis

Path Traversal in Grafana Tempo and Loki Datasource Plugins

Publication date: 2026-06-22

Last updated on: 2026-07-10

Assigner: Grafana Labs

Description

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-07-10

Generated

2026-07-12

AI Q&A

2026-06-22

EPSS Evaluated

2026-07-11

NVD

CVE-2026-10601

EUVD

EUVD-2026-38242

Affected Vendors & Products

Vendor	Product	Version / Range
grafana	grafana	11.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Tempo and Loki datasource plugins, where they construct backend HTTP requests by inserting user-supplied input directly into URL paths without proper sanitization. This lack of sanitization enables path traversal attacks.

A user with Viewer role can exploit this to: (1) capture admin-configured datasource credentials by redirecting requests to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo such as /flush or /shutdown, and (3) exfiltrate internal service data through Loki's CallResource feature which returns full HTTP response bodies.

Impact Analysis

The vulnerability can lead to several impacts including unauthorized access to sensitive admin credentials, unauthorized execution of administrative actions on the Tempo service, and leakage of internal service data.

Exposure of admin-configured datasource credentials to attackers.
Ability for a Viewer-role user to perform state-changing operations on Tempo, potentially disrupting service.
Exfiltration of internal service data via Loki's CallResource, which could lead to data breaches.

Compliance Impact

This vulnerability allows a Viewer-role user to capture admin-configured datasource credentials, invoke state-changing admin endpoints, and exfiltrate internal service data. Such unauthorized access and data exfiltration could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over sensitive data and system integrity.

Specifically, the exposure of credentials and internal data may result in unauthorized disclosure of personal or sensitive information, undermining confidentiality requirements. Additionally, the ability to invoke administrative actions could impact system availability and integrity, further affecting compliance.

Hi! I’m here to help you understand CVE-2026-10601. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70