~ / search / GHSA-9493-h4f5-633x

GHSA-9493-h4f5-633x

Grafana: Path traversal in the Tempo and Loki data source plugins

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-10601

Packages

EcosystemPackageAffectedFixed in
Go github.com/grafana/grafana < 11.6.15 no fix listed
Go github.com/grafana/grafana < 12.2.9 no fix listed
Go github.com/grafana/grafana < 12.3.7 no fix listed
Go github.com/grafana/grafana < 13.0.2 no fix listed
Go github.com/grafana/grafana < 12.4.4 no fix listed
Go github.com/grafana/grafana < 1.9.2-0.20260616075434-82ef13993059 1.9.2-0.20260616075434-82ef13993059

Details

As written in the advisory (Markdown source, shown as plain text).

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.

References

External links from the advisory. They lead to third-party sites.