CVE-2026-10601CWE-22

Path traversal in the Tempo and Loki data source plugins

Medium · published June 22, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-22T13:18Z
EPSS history
Timeline
  • 22 JUN 13:18Z
    Path traversal in the Tempo and Loki data source plugins
    cvelistv5