GitHub Advisoryadvisory · Go

GHSA-9493-h4f5-633x Grafana: Path traversal in the Tempo and Loki data source plugins

MEDIUM Published 2026-06-22 Modified 2026-09-21 Official page ↗
Aliases
CVE-2026-10601
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-22
Reviewed
2026-09-21

Affected packages

• Go github.com/grafana/grafana: < 11.6.15 (no fix yet) • Go github.com/grafana/grafana: < 12.2.9 (no fix yet) • Go github.com/grafana/grafana: < 12.3.7 (no fix yet) • Go github.com/grafana/grafana: < 13.0.2 (no fix yet) • Go github.com/grafana/grafana: < 12.4.4 (no fix yet) • Go github.com/grafana/grafana: < 1.9.2-0.20260616075434-82ef13993059 → fixed in 1.9.2-0.20260616075434-82ef13993059

Description

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.

Related

Alias · CVE (1)

  • CVE-2026-10601 A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References