CVE-2026-10601: Path traversal in the Tempo and Loki data source plugins
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10601?
CVE-2026-10601 has a medium severity rating of 5.4.
How could CVE-2026-10601 affect my system?
CVE-2026-10601 could allow a Viewer-role user to capture admin-configured datasource credentials due to a path traversal vulnerability.
What software is impacted by CVE-2026-10601?
CVE-2026-10601 affects the Grafana Tempo and Grafana Loki data source plugins.
How do I fix CVE-2026-10601?
To fix CVE-2026-10601, ensure that user-supplied input is properly sanitized before being interpolated into URL paths.
What is the nature of the vulnerability in CVE-2026-10601?
CVE-2026-10601 is a path traversal vulnerability that allows unauthorized access to sensitive information.