Описание
Grafana: Path traversal in the Tempo and Loki data source plugins
The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2026-10601
- https://github.com/grafana/grafana/pull/125789
- https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1
- https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29
- https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4
- https://github.com/grafana/grafana/commit/d27d2eba9c509d16f214d290436a6ad0bd9c6c01
- https://github.com/grafana/grafana/commit/dd5dc51681ff0133ddb2e206c2ea318713aeca16
- https://github.com/grafana/grafana/commit/f70d3e480274a5dbd12006338c393f4b05d441ca
- https://github.com/grafana/grafana/releases/tag/v11.6.15
- https://github.com/grafana/grafana/releases/tag/v12.2.9
- https://github.com/grafana/grafana/releases/tag/v12.3.7
- https://github.com/grafana/grafana/releases/tag/v12.4.4
- https://github.com/grafana/grafana/releases/tag/v13.0.2
- https://grafana.com/security/security-advisories/cve-2026-10601
Пакеты
github.com/grafana/grafana
>= 2.0.0-beta1
Отсутствует
github.com/grafana/grafana
>= 12.0.0
Отсутствует
github.com/grafana/grafana
>= 12.3.0
Отсутствует
github.com/grafana/grafana
>= 13.0.0
Отсутствует
github.com/grafana/grafana
>= 12.4.0
Отсутствует
github.com/grafana/grafana
< 1.9.2-0.20260616075434-82ef13993059
1.9.2-0.20260616075434-82ef13993059
Связанные уязвимости
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Уязвимость платформы для мониторинга и наблюдения Grafana, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации