BIT-grafana-2026-10601

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-10601.json

JSON Data

https://api.test.osv.dev/v1/vulns/BIT-grafana-2026-10601

Aliases

Published

2026-06-26T08:42:32Z

Modified

2026-09-21T23:25:42Z

Summary

Path traversal in the Tempo and Loki data source plugins

Details

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Database specific

{
    "cpes": [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:*:go:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / grafana

Package

Name: grafana
Purl: pkg:bitnami/grafana

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

11.6.15

Introduced

12.0.0

Fixed

12.2.9

Introduced

12.3.0

Fixed

12.3.7

Introduced

12.4.0

Fixed

12.4.4

Introduced

13.0.0

Fixed

13.0.2

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-10601.json"