CVE-2026-10601— Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Grafana | Grafana OSS | 11.6.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-10601
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal in Tempo and Loki Data Source Plugins — Credential Leakage and Admin Endpoint Access
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Grafana OSS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grafana OSS是Grafana公司开源的一个可视化仪表盘。 Grafana OSS 11.6.0版本存在安全漏洞，该漏洞源于Tempo和Loki datasource plugins在构造后端HTTP请求时将用户输入插入URL路径而未进行清理，可能导致路径遍历攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Grafana | Grafana OSS | 11.6.0 | - |
II. Public POCs for CVE-2026-10601
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10601
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-10601 (1)
Same Patch Batch · Grafana · 2026-06-22 · 5 CVEs total
| CVE-2026-28381 | 9.6 CRITICAL | Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT |
| CVE-2026-42129 | 7.7 HIGH | Path Traversal in Loki Datasource leads to Internal Information Disclosure |
| CVE-2026-42127 | 7.5 HIGH | Grafana pre-auth DoS through arbitrarily large input to public dashboard query handler |
| CVE-2026-9029 | 7.3 HIGH | Stored XSS via Geomap Panel Template Variable Attribution Injection |
IV. Related Vulnerabilities
Same product: Grafana OSS
- CVE-2026-9029
Stored XSS via Geomap Panel Template Variable Attribution In - CVE-2026-42129
Path Traversal in Loki Datasource leads to Internal Informat - CVE-2026-28374
IDOR in Annotations API allows unprivileged users to DELETE - CVE-2026-33378
Grafana Data Source Plugin: DoS (OOM) via Negative Interval - CVE-2026-28383
Grafana plugin resources can lead to unbounded memory alloca
Same vendor: Grafana
- CVE-2026-28378
Cross-Organization Public Dashboard Deletion via Missing Org - CVE-2026-42127
Grafana pre-auth DoS through arbitrarily large input to publ - CVE-2026-28381
Local File Read/Write to Potential Privilege Escalation via - CVE-2026-9029
Stored XSS via Geomap Panel Template Variable Attribution In - CVE-2026-42129
Path Traversal in Loki Datasource leads to Internal Informat
V. Comments for CVE-2026-10601
No comments yet