CVE-2026-10601 Path traversal in the Tempo and Loki data source plugins
A Viewer can exploit path traversal in Tempo and Loki plugins to access backend endpoints, potentially leaking credentials or triggering administrative actions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10601?
CVE-2026-10601 is a medium-severity path traversal vulnerability in Grafana Grafana, published on 22 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Weakness: CWE-22
Which versions are affected by CVE-2026-10601?
15 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | None |
github.com/grafana/grafana Go | All versions | 1.9.2-0.20260616075434-82ef13993059 |
github.com/grafana/grafana Go | All versions | 1.9.2-0.20260616075434-82ef13993059 |
github.com/grafana/grafana Go | From 12.0.0 | None |
github.com/grafana/grafana Go | From 12.0.0 | None |
github.com/grafana/grafana Go | From 12.3.0 | None |
9 more packages
github.com/grafana/grafana Go | From 12.3.0 | None |
github.com/grafana/grafana Go | From 12.4.0 | None |
github.com/grafana/grafana Go | From 12.4.0 | None |
github.com/grafana/grafana Go | From 13.0.0 | None |
github.com/grafana/grafana Go | From 13.0.0 | None |
github.com/grafana/grafana Go | From 2.0.0-beta1 | None |
github.com/grafana/grafana Go | From 2.0.0-beta1 | None |
github.com/grafana/grafana Go | From 2.0.0-beta1+incompatible | None |
grafana Bitnami | All versions | 11.6.15, 12.2.9, 12.3.7, 12.4.4, 13.0.2 |
Linux distribution packages (6)
loki3.6 Red Hat:hummingbird:1 | All versions | 0:3.6.16-0.1.hum1 |
loki3.6-canary Red Hat:hummingbird:1 | All versions | 0:3.6.16-0.1.hum1 |
loki3.6-logcli Red Hat:hummingbird:1 | All versions | 0:3.6.16-0.1.hum1 |
loki3.7 Red Hat:hummingbird:1 | All versions | 0:3.7.7-0.1.hum1 |
loki3.7-canary Red Hat:hummingbird:1 | All versions | 0:3.7.7-0.1.hum1 |
loki3.7-logcli Red Hat:hummingbird:1 | All versions | 0:3.7.7-0.1.hum1 |
Products include Grafana Grafana.
How do I fix CVE-2026-10601?
Upgrade github.com/grafana/grafana to 1.9.2-0.20260616075434-82ef13993059 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-10601 being exploited?
There is no known exploitation of CVE-2026-10601 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-10601, GHSA-9493-h4f5-633x, GO-2026-6545, MINI-2fc2-27hq-x36f, MINI-3p3v-pg5c-mgjg, MINI-4jgq-22g7-879f and 17 more.