CVE-2026-10601
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Summary
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Grafana | Grafana OSS | 11.6.0 <= 11.6.14 | affected |
| Grafana | Grafana OSS | 12.2.0 <= 12.2.8 | affected |
| Grafana | Grafana OSS | 12.3.0 <= 12.3.6 | affected |
| Grafana | Grafana OSS | 12.4.0 <= 12.4.3 | affected |
| Grafana | Grafana OSS | 13.0.0 <= 13.0.1 | affected |
Weaknesses
- CWE-22: CWE-22
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.