CVE-2026-10601: Path traversal in the Tempo and Loki data source plugins

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-22 · updated 2026-10-25
Weakness: CWE-22

Description

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Affected products

Grafana: 11.6.0

References

https://grafana.com/security/security-advisories/cve-2026-10601

Get alerted when CVE-2026-10601 or the next vulnerability affects your stack