Description
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana OSS | 11.6.0 – ≤ 11.6.14, 12.2.0 – ≤ 12.2.8, 12.3.0 – ≤ 12.3.6, 12.4.0 – ≤ 12.4.3, 13.0.0 – ≤ 13.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.4.hum1 | RHSA-2026:68143 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.9.hum1 | RHSA-2026:67573 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.4.hum1 | RHSA-2026:67605 |
| Red Hat Hardened Images 1 | loki3.6 +2 | 3.6.16-0.1.hum1 | RHSA-2026:64525 |
| Red Hat Hardened Images 1 | loki3.7 +2 | 3.7.7-0.1.hum1 | RHSA-2026:64585 |
| Red Hat Hardened Images 1 | tempo2.10 | 2.10.8-0.2.hum1 | RHSA-2026:62527 |
| Red Hat Hardened Images 1 | tempo3.0 | 3.0.3-0.2.hum1 | RHSA-2026:62537 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 2.0.0-beta1 | — | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | >= 12.0.0 | — | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | >= 12.3.0 | — | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | >= 13.0.0 | — | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | >= 12.4.0 | — | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | < 1.9.2-0.20260616075434-82ef13993059 | 1.9.2-0.20260616075434-82ef13993059 | GHSA-9493-h4f5-633x |
| Go | github.com/grafana/grafana | all versions | — | GO-2026-6545 |
| Go | github.com/grafana/grafana | >= 2.0.0-beta1+incompatible | — | GO-2026-6545 |
Advisories 7
- RHSA-2026:67605 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67573 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68143 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:62527 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:62537 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:64525 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:64585 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 22, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-10601 vendor-advisory