{"id":"CVE-2026-10601","revision":"15f804cf1bf04b3881bd7bae82aad44b","records":[{"revision":"15f804cf1bf04b3881bd7bae82aad44b","observedAt":"2026-10-25T04:17:41.466+00:00","statement":{"source":"nvd","id":"CVE-2026-10601","aliases":[],"title":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal…","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","state":0,"publishedAt":"2026-06-22T14:16:25.167+00:00","modifiedAt":"2026-07-10T16:16:22.733+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security@grafana.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":5.4,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://grafana.com/security/security-advisories/cve-2026-10601"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10601","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-22"],"productCriteria":["cpe:2.3:a:grafana:grafana:11.6.0:-:*:*:-:*:*:*"],"sourceDates":{"published":"2026-06-22T14:16:25.167","lastModified":"2026-07-10T16:16:22.733"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-10601","identifiers":["CVE-2026-10601"]},"retained":false,"historicalAffected":[]}],"coverage":[]}