CVE-2026-10601
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
- CVSS 3.1
- 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-25)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grafana:grafana
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9493-h4f5-633x | Go | github.com/grafana/grafana | >=2.0.0-beta1 | no fix published |
| GHSA-9493-h4f5-633x | Go | github.com/grafana/grafana | >=12.0.0 | no fix published |
| GHSA-9493-h4f5-633x | Go | github.com/grafana/grafana | >=12.3.0 | no fix published |
| GHSA-9493-h4f5-633x | Go | github.com/grafana/grafana | >=13.0.0 | no fix published |
| GHSA-9493-h4f5-633x | Go | github.com/grafana/grafana | >=12.4.0 | no fix published |
| GHSA-9493-h4f5-633x | Go | github.com/grafana/grafana | <1.9.2-0.20260616075434-82ef13993059 | 1.9.2-0.20260616075434-82ef13993059 |
| GO-2026-6545 | Go | github.com/grafana/grafana | all versions | no fix published |
| GO-2026-6545 | Go | github.com/grafana/grafana | all versions | no fix published |
| GO-2026-6545 | Go | github.com/grafana/grafana | all versions | no fix published |
| GO-2026-6545 | Go | github.com/grafana/grafana | all versions | no fix published |
| GO-2026-6545 | Go | github.com/grafana/grafana | all versions | no fix published |
| GO-2026-6545 | Go | github.com/grafana/grafana | >=2.0.0-beta1+incompatible | no fix published |