CVE-2026-10601 — MEDIUM (5.4)

Vulnerability Description

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Grafana	Grafana	11.6.0

Related Weaknesses (CWE)

CWE-22

References

https://grafana.com/security/security-advisories/cve-2026-10601Broken Link

FAQ

What is CVE-2026-10601?

CVE-2026-10601 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expos...

How severe is CVE-2026-10601?

CVE-2026-10601 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-10601?

Check the references section above for vendor advisories and patch information. Affected products include: Grafana Grafana.