PkgSeer

Vulnerability GHSA-9493-h4f5-633x

Medium Risk

3 months ago

Grafana: Path traversal in the Tempo and Loki data source plugins

v0.0.0-cloud - v6.1.6+incompatible

Summary

Grafana: Path traversal in the Tempo and Loki data source plugins

Details

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-6541

Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-6542

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-6544

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-6545

Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-5708

View all vulnerabilities for these packages

Impacted packages

github.com/grafana/grafana

Timeline

Published

3 months ago

Last Modified

2 hours ago