Most recent entries from all

bdu:2026-10549

2026-10-03T14:41:56.335444+00:00

bdu:2026-10549

BIT-grafana-2026-10601 — Path traversal in the Tempo and Loki data source plugins

2026-10-03T14:41:56.335484+00:00

Affected: Bitnami: grafana

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

EUVD-2026-360220

2026-10-03T14:41:56.335516+00:00

EUVD-2026-360220

fkie_cve-2026-10601

2026-10-03T14:41:56.335529+00:00

GHSA-9493-h4f5-633x — Grafana: Path traversal in the Tempo and Loki data source plugins

2026-10-03T14:41:56.335550+00:00

Affected: Go: github.com/grafana/grafana

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.

RHSA-2026:62527 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

2026-10-03T14:41:56.335575+00:00

grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerability due to missing Host header validation