CVE-2026-10601

🔶 medium

Summary

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

CVSS Score

5.4

Medium

EPSS Score

0.3

Exploit Probability

Published Date

2026-06-22

First Seen: 2026-06-25

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 22.2% of all 365,890 vulnerabilities in our database.

#284,616

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jun 22, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

homb (Researcher)

SSVC data provided by CISA

Last Modified 2026-07-10

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CWE IDs (Weakness Types)

CWE-22

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
grafana	grafana	Affected	v11.6.0

🔗 References 1

https://grafana.com/security/security-advisories/cve...

Broken Link

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-14199	⚠️ high	7.1	0.3	Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z...	2026-09-02
CVE-2026-33382	⚠️ high	7.5	0.4	Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing...	2026-07-10
CVE-2026-8595	🔶 medium	6.8	0.2	A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that ex...	2026-07-10
CVE-2026-8609	🔶 medium	5.3	0.4	An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory...	2026-07-10
CVE-2026-28378	ℹ️ low	3.1	0.1	The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organizatio...	2026-07-07
CVE-2026-9029	⚠️ high	7.3	0.3	A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer ...	2026-06-22

These CVEs affect the same products