Vulnerability · Published Jun 22, 2026 · Assigned by GRAFANA
CVE-2026-10601Path traversal in the Tempo and Loki data source plugins
Medium 5.4
In plain English
A medium-severity path traversal in Grafana OSS from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | grafana | 12.4.4-r0 | ALPINE-CVE-2026-10601 |
| Go | github.com/grafana/grafana | no fix listed | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | no fix listed | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | no fix listed | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | no fix listed | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | no fix listed | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | 1.9.2-0.20260616075434-82ef13993059 | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | no fix listed | GO-2026-6545 |
| Go | github.com/grafana/grafana | no fix listed | GO-2026-6545 |
| Go | github.com/grafana/grafana | no fix listed | GO-2026-6545 |
| Go | github.com/grafana/grafana | no fix listed | GO-2026-6545 |
| Go | github.com/grafana/grafana | no fix listed | GO-2026-6545 |
| Go | github.com/grafana/grafana | no fix listed | GO-2026-6545 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana OSS | 11.6.0 – through 11.6.1412.2.0 – through 12.2.812.3.0 – through 12.3.612.4.0 – through 12.4.313.0.0 – through 13.0.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- https://grafana.com/security/security-advisories/cve-2026-10601 vendor-advisory