Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-41118 · Microsoft / collected KEV context

EUVD-2025-209489

GHSA-m9hq-h476-h2g8

BIT-grafana-pyroscope-2025-41118

GO-2026-5501

cve-program · CVE-2025-41118

• https://grafana.com/security/security-advisories/cve-2025-41118

euvd · EUVD-2025-209489

• https://grafana.com/security/security-advisories/cve-2025-41118

nvd · CVE-2025-41118

• https://grafana.com/security/security-advisories/cve-2025-41118
• https://access.redhat.com/errata/RHSA-2026:24503
• https://access.redhat.com/security/cve/CVE-2025-41118
• https://bugzilla.redhat.com/show_bug.cgi?id=2458796
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-41118.json

osv · GHSA-m9hq-h476-h2g8

• https://nvd.nist.gov/vuln/detail/CVE-2025-41118
• https://github.com/grafana/pyroscope
• https://grafana.com/security/security-advisories/cve-2025-41118

osv · GO-2026-5501

• https://github.com/advisories/GHSA-m9hq-h476-h2g8
• https://nvd.nist.gov/vuln/detail/CVE-2025-41118
• https://grafana.com/security/security-advisories/cve-2025-41118

No related operational record is retained in the current change model.