CVE-2026-10601

Name of the Vulnerable Software and Affected Versions Tempo datasource plugin (affected versions not specified) Loki datasource plugin (affected versions not specified)

Description These plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, which allows for path traversal. A user with a Viewer role can capture admin-configured datasource credentials, specifically secureJsonData custom headers, by traversing to an attacker-controlled endpoint. Additionally, this allows for the invocation of state-changing admin endpoints on Tempo, such as '/flush' and '/shutdown', and the exfiltration of internal service data through Loki's CallResource, which returns full HTTP response bodies.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.