BIT-grafana-2026-10601

vendorUSosv

Path traversal in the Tempo and Loki data source plugins

view advisory published 2026-06-26Licence: per source

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-10601US	medium4.3	0.29% (21st)	—	2026-06-22
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configur…

references

External citations — patches, advisories, analysis.

https://grafana.com/security/security-advisories/cve-2026-10601WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-10601WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan