medium5.4
CVE-2026-10601
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints.
Impact
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/grafana/grafana | >= 2.0.0-beta1, < 11.6.15 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Grafana | Version 11.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-9493-h4f5-633x
- https://nvd.nist.gov/vuln/detail/CVE-2026-10601
- https://grafana.com/security/security-advisories/cve-2026-10601
- https://github.com/grafana/grafana/pull/125789
- https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1
- https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29
- https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4
- https://github.com/grafana/grafana/commit/d27d2eba9c509d16f214d290436a6ad0bd9c6c01
- https://github.com/grafana/grafana/commit/dd5dc51681ff0133ddb2e206c2ea318713aeca16
- https://github.com/grafana/grafana/commit/f70d3e480274a5dbd12006338c393f4b05d441ca
- https://github.com/grafana/grafana/releases/tag/v11.6.15
- https://github.com/grafana/grafana/releases/tag/v12.2.9
- https://github.com/grafana/grafana/releases/tag/v12.3.7
- https://github.com/grafana/grafana/releases/tag/v12.4.4
- https://github.com/grafana/grafana/releases/tag/v13.0.2