VULNERABILITY INTELLIGENCE

CVE-2026-10601

CVSS score5.4 MEDIUM
EPSS probability0.29%
CISA KEVNot currently listed
Published2026-06-22
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Description

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Weakness classification

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references