CVE-2026-10601 — Path traversal in the Tempo and Loki data source plugins
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend confi…
Published: 2026-06-22 · CVSS: 5.4 · CVSS 3.1
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7