CVE-2026-10601 — Path traversal in the Tempo and Loki data source plugins

CVE-2026-10601

Path traversal in the Tempo and Loki data source plugins PUBLISHED

Description (CNA)

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana OSS	affected 11.6.0 through 11.6.14; affected 12.2.0 through 12.2.8; affected 12.3.0 through 12.3.6; affected 12.4.0 through 12.4.3; affected 13.0.0 through 13.0.1

CWE

CWE-22

References

https://grafana.com/security/security-advisories/cve-2026-10601

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.