{"id":"EUVD-2026-38242","enisaUuid":"f010bc9f-512e-3b23-96f0-a519e8995bbc","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","datePublished":"Jun 22, 2026, 1:18:31 PM","dateUpdated":"Aug 27, 2026, 5:22:42 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://grafana.com/security/security-advisories/cve-2026-10601\n","aliases":"CVE-2026-10601\nGHSA-9493-h4f5-633x\n","assigner":"GRAFANA","epss":0.29,"enisaIdProduct":[{"id":"1e87beb3-1d72-31b9-86dc-a85c34238d14","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.2.0 ≤12.2.8"},{"id":"547d3bf9-cb33-3912-a4ca-9ce46dc28830","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.3.0 ≤12.3.6"},{"id":"64f7c156-d927-3d30-9632-c49767ad1fc2","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"13.0.0 ≤13.0.1"},{"id":"76ac2a70-12a6-394e-a555-6f4acefdf121","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.4.0 ≤12.4.3"},{"id":"edd8bb2a-c40e-3f04-9155-544ccba36e80","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"11.6.0 ≤11.6.14"}],"enisaIdVendor":[{"id":"4eb35039-e807-34ff-adc4-2bda4745c64b","vendor":{"name":"Grafana"}}],"enisaIdVulnerability":[{"id":"612898f3-a134-3e97-8a2f-6e2b32ca12d0","vulnerability":{"id":"CVE-2026-10601","description":"A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.","datePublished":"Jun 22, 2026, 1:18:31 PM","dateUpdated":"Aug 27, 2026, 5:22:42 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://grafana.com/security/security-advisories/cve-2026-10601\n","enisa_id":"EUVD-2026-38242\n","assigner":"GRAFANA","epss":0.29,"dataProcessed":"Nov 6, 2026, 7:15:55 AM","vulnerabilityProduct":[{"id":"6125961e-6659-3100-84be-19a7bab019a5","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"11.6.0 ≤11.6.14"},{"id":"87de6b14-47c0-3381-a81d-205aae2efd7c","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.4.0 ≤12.4.3"},{"id":"bdb8437e-592e-3417-a0fb-4feb67450939","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.3.0 ≤12.3.6"},{"id":"c82f3195-686e-3129-bca0-95a90f44fec8","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.2.0 ≤12.2.8"},{"id":"f7106a2a-dc25-3e0a-91e9-32a55f1b85bc","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"13.0.0 ≤13.0.1"}],"vulnerabilityVendor":[{"id":"ddccaf9d-2794-371a-b42b-e60d2f5c7c90","vendor":{"name":"Grafana"}}]}},{"id":"d93f5978-0840-37e1-b079-425092b900d9","vulnerability":{"id":"GHSA-9493-h4f5-633x","description":"Grafana: Path traversal in the Tempo and Loki data source plugins","datePublished":"Jun 22, 2026, 3:30:43 PM","dateUpdated":"Sep 21, 2026, 11:03:34 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-10601\nhttps://github.com/grafana/grafana/pull/125789\nhttps://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1\nhttps://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29\nhttps://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4\nhttps://github.com/grafana/grafana/commit/d27d2eba9c509d16f214d290436a6ad0bd9c6c01\nhttps://github.com/grafana/grafana/commit/dd5dc51681ff0133ddb2e206c2ea318713aeca16\nhttps://github.com/grafana/grafana/commit/f70d3e480274a5dbd12006338c393f4b05d441ca\nhttps://github.com/grafana/grafana\nhttps://github.com/grafana/grafana/releases/tag/v11.6.15\nhttps://github.com/grafana/grafana/releases/tag/v12.2.9\nhttps://github.com/grafana/grafana/releases/tag/v12.3.7\nhttps://github.com/grafana/grafana/releases/tag/v12.4.4\nhttps://github.com/grafana/grafana/releases/tag/v13.0.2\nhttps://grafana.com/security/security-advisories/cve-2026-10601\n","enisa_id":"EUVD-2026-38242\n","aliases":"CVE-2026-10601\nGHSA-9493-h4f5-633x\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"0de5e238-88cb-3e35-9df1-4c05726eda2e","advisory":{"id":"RHSA-2026:67605","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 15, 2026, 2:39:47 PM","dateUpdated":"Oct 20, 2026, 4:08:51 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:67605\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67605.json\n","aliases":"CVE-2026-9029\nCVE-2026-10601\nCVE-2026-61709\nCVE-2026-90771\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"70affe73-152c-34fd-98ab-df94e7ed21d1","product":{"name":"grafana13.2-0:13.2.1-0.4.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"c1a7aab4-cb18-3bed-91ad-71660f08d206","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"d353b9ba-fa4b-3e79-b709-8dc5ff9c16ed","product":{"name":"grafana13.2-0:13.2.1-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"dd0bdc38-80ed-3c6f-bd1e-577f22159d9b","product":{"name":"grafana13.2-0:13.2.1-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"7927c0c7-47cd-3741-ab06-ba0a08cf61c8","advisory":{"id":"RHSA-2026:67573","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 15, 2026, 2:19:34 PM","dateUpdated":"Oct 23, 2026, 4:06:31 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:67573\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67573.json\n","aliases":"CVE-2026-9029\nCVE-2026-10601\nCVE-2026-75838\nCVE-2026-90771\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"207d4e7b-7044-3202-bafc-ff312719eeec","product":{"name":"grafana13.1-0:13.1.3-0.9.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"41057ed4-db60-3582-86a2-cf1e0316deba","product":{"name":"grafana13.1-0:13.1.3-0.9.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"938ec239-a7a6-37d5-8c2c-4f7e4aef0ece","product":{"name":"grafana13.1-0:13.1.3-0.9.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"ce9dc593-3f14-326e-93bf-c52ca21be0bc","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}}]}},{"id":"84e6b360-133f-3d44-aa32-2ec31ee1fec5","advisory":{"id":"RHSA-2026:64585","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 6, 2026, 6:37:05 PM","dateUpdated":"Sep 21, 2026, 11:39:26 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:64585\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64585.json\n","aliases":"CVE-2026-10601\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"047b5de1-d2b7-3799-8dfd-48eb7fac10bd","product":{"name":"loki3.7-0:3.7.7-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"2041692a-ec39-3305-bf0d-b82636aabdf8","product":{"name":"loki3.7-logcli-0:3.7.7-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"4801a786-169e-36b9-a495-c900731cd5b6","product":{"name":"loki3.7-canary-0:3.7.7-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"7c306885-f4af-3e11-91f4-ddef4719ff58","product":{"name":"loki3.7-canary-0:3.7.7-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"9e3679f0-4b36-33fe-b1cc-e8ca60a1ae8e","product":{"name":"loki3.7-0:3.7.7-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"acbde307-2f31-3682-8f4e-5d60029cfb65","product":{"name":"loki3.7-0:3.7.7-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"cca802df-bb71-303c-b811-1ebcdb5d2c24","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"fbb2d4b5-3b2c-3a20-bce8-088f65ee0bfc","product":{"name":"loki3.7-logcli-0:3.7.7-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}},{"id":"b08125d1-480f-3d92-9eb5-a2a2d6c89dc0","advisory":{"id":"RHSA-2026:64525","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 6, 2026, 5:54:23 PM","dateUpdated":"Sep 21, 2026, 11:42:19 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:64525\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64525.json\n","aliases":"CVE-2026-10601\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"029a613f-7bf6-361c-ae35-1363c5448c7c","product":{"name":"loki3.6-canary-0:3.6.16-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"05a3cedb-921d-3140-97f2-7a5672b4c196","product":{"name":"loki3.6-0:3.6.16-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"3899eb6a-2986-309f-abf4-1d1ffc4b97e7","product":{"name":"loki3.6-0:3.6.16-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"61ad4a40-dfa2-3420-8e70-74d63038bf53","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"74a9bdae-b52e-33a9-a365-ab64f34a1c16","product":{"name":"loki3.6-0:3.6.16-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"7efccdc0-4e2e-3161-8155-3bb65b7a7ffa","product":{"name":"loki3.6-logcli-0:3.6.16-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"9d9cd6f9-4367-3d69-932b-e3863edfb25e","product":{"name":"loki3.6-logcli-0:3.6.16-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"c08aff76-cb4e-38ba-a72f-d8238d46b8f8","product":{"name":"loki3.6-canary-0:3.6.16-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}},{"id":"c5399628-4990-3f14-a136-06cb356c8140","advisory":{"id":"RHSA-2026:68143","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 16, 2026, 2:22:20 PM","dateUpdated":"Oct 30, 2026, 7:27:21 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:68143\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68143.json\n","aliases":"CVE-2026-9029\nCVE-2026-10601\nCVE-2026-86472\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"2627fa92-41c0-3bec-b413-fec9369d2801","product":{"name":"grafana12.4-0:12.4.10-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"a3260608-964c-39f8-a330-1c2c201c4f21","product":{"name":"grafana12.4-0:12.4.10-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"a5e92a96-807d-3f22-9b3a-71d3d5b0c649","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"c0afb105-6df3-388c-86c8-8495a0026968","product":{"name":"grafana12.4-0:12.4.10-0.4.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"f7133382-7a96-3df7-b16c-5420cd40224f","advisory":{"id":"RHSA-2026:62527","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 2, 2026, 8:01:52 AM","dateUpdated":"Sep 21, 2026, 11:42:21 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:62527\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62527.json\n","aliases":"CVE-2026-10601\nCVE-2026-81092\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0ad41592-72c9-3c43-9753-b8f28f09e116","product":{"name":"tempo2-10-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"2b694262-36e8-3a6a-9ed2-4afcae7df225","product":{"name":"tempo2.10-0:2.10.8-0.2.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"3868528c-c18c-357c-b873-e8c94ec694a3","product":{"name":"tempo2.10-0:2.10.8-0.2.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"3f9e3a1d-3e65-33c7-83bf-705743e63adf","product":{"name":"tempo2.10-0:2.10.8-0.2.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"d132f332-0f9e-3cb4-9348-a3b859c3d7db","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"ed09ea5a-83fc-34a5-a014-5dc83db11184","product":{"name":"tempo2-10-main@aarch64","vendor":{"name":"Red Hat"}}},{"id":"ed95a7e4-87d5-327c-9c59-a9069c5f6f2d","product":{"name":"tempo2-10-main@src","vendor":{"name":"Red Hat"}}}]}},{"id":"f7657caf-3ed4-3d67-95d6-028d02697970","advisory":{"id":"RHSA-2026:62537","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 2, 2026, 8:21:17 AM","dateUpdated":"Sep 21, 2026, 11:45:02 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:62537\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62537.json\n","aliases":"CVE-2026-10601\nCVE-2026-81092\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"1276686e-9c21-31c1-8d42-c2770c6cfa0c","product":{"name":"tempo3.0-0:3.0.3-0.2.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"5b6e3d6b-6e9f-3554-8e50-c46b48140d3c","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"66aa8e3b-592d-34e3-baaf-bbeecd36f742","product":{"name":"tempo3.0-0:3.0.3-0.2.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"72e65f69-2346-3e9a-9c3d-41c0d46e2499","product":{"name":"tempo3.0-0:3.0.3-0.2.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"80c6d9f1-ccb1-3f1e-bb05-bf3a9dc8be05","product":{"name":"tempo3-0-main@aarch64","vendor":{"name":"Red Hat"}}},{"id":"9501515b-ec8b-3d58-9086-95e6ca340bb5","product":{"name":"tempo3-0-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"bbfe3a65-3021-35a5-9cf1-c36dcabae867","product":{"name":"tempo3-0-main@src","vendor":{"name":"Red Hat"}}}]}}]}