MEDIUMCVSS 5.4EPSS 0.3%

CVE-2026-10601

CVE-2026-10601 updated by NVD

Published: 2026-06-22
Modified: 2026-10-27
EPSS percentile: 21%
Sources: github-advisory, nvd

Summary

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/grafana/grafana	—	1.9.2-0.20260616075434-82ef13993059

Remediation: Upgrade to 1.9.2-0.20260616075434-82ef13993059 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-10601

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.