https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:36:32 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10549 bdu:2026-10549 https://cve.radiocsirt.org/vuln/bdu:2026-10549 https://cve.radiocsirt.org/vuln/bit-grafana-2026-10601 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.</p> https://cve.radiocsirt.org/vuln/bit-grafana-2026-10601 https://cve.radiocsirt.org/vuln/euvd-2026-360220 EUVD-2026-360220 https://cve.radiocsirt.org/vuln/euvd-2026-360220 https://cve.radiocsirt.org/vuln/fkie_cve-2026-10601 <p>A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.</p> <p>A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-10601 https://cve.radiocsirt.org/vuln/ghsa-9493-h4f5-633x <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki&#39;s CallResource which returns full HTTP response bodies.</p> <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki&#39;s CallResource which returns full HTTP response bodies.</p> https://cve.radiocsirt.org/vuln/ghsa-9493-h4f5-633x https://cve.radiocsirt.org/vuln/rhsa-2026:62527 <p>grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerability due to missing Host header validation</p> <p>grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerability due to missing Host header validation</p> https://cve.radiocsirt.org/vuln/rhsa-2026:62527