Homb

**Name of the Vulnerable Software and Affected Versions** Tempo datasource plugin (affected versions not specified) Loki datasource plugin (affected versions not specified) **Description** These plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, which allows for path traversal. A user with a Viewer role can capture admin-configured datasource credentials, specifically `secureJsonData` custom headers, by traversing to an attacker-controlled endpoint. Additionally, this allows for the invocation of state-changing admin endpoints on Tempo, such as '/flush' and '/shutdown', and the exfiltration of internal service data through Loki's `CallResource`, which returns full HTTP response bodies. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.