CVE-2026-10601: Tempo & Loki Path Traversal Vulnerability

CVE-2026-10601 Overview

CVE-2026-10601 is a path traversal vulnerability [CWE-22] in the Grafana Tempo and Loki datasource plugins. The plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization. A user holding only the Viewer role can abuse this flaw to redirect backend requests to attacker-controlled endpoints or to sensitive internal paths.

The issue enables three concrete attack outcomes: theft of admin-configured datasource credentials stored in secureJsonData custom headers, invocation of state-changing Tempo admin endpoints such as /flush and /shutdown, and exfiltration of internal service data through Loki's CallResource interface, which returns full HTTP response bodies.

Critical Impact
A low-privileged Viewer can capture admin credentials, trigger Tempo administrative actions, and read internal HTTP responses through path traversal in backend datasource requests.

Affected Products

Grafana Tempo datasource plugin
Grafana Loki datasource plugin
Grafana instances exposing these datasources to Viewer-role users

Discovery Timeline

2026-06-22 - CVE-2026-10601 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-10601

Vulnerability Analysis

The Tempo and Loki datasource plugins act as backend proxies inside Grafana. When a user issues a query, the plugins build outbound HTTP requests by concatenating user-controlled segments directly into the destination URL path. Because input is not normalized or validated, sequences such as ../ and absolute path overrides change the effective target of the request.

Three distinct exploitation paths follow from the same root cause. First, the plugins attach configured authentication material from secureJsonData, including custom headers, to every outbound request. By traversing the URL to an attacker-controlled host, a Viewer captures those headers and recovers admin-provisioned credentials. Second, Tempo exposes operational endpoints like /flush and /shutdown that should be unreachable by query traffic. Path traversal reaches them through the authenticated backend. Third, Loki's CallResource returns the full HTTP response body to the caller, turning the proxy into a generic internal HTTP read primitive.

The vulnerability requires authentication but only at the Viewer level, which is the lowest privileged role in Grafana and is commonly granted broadly.

Root Cause

The root cause is missing input sanitization during URL construction in the Tempo and Loki plugin backends. User-supplied identifiers are interpolated into path templates without validating that they remain within the intended resource namespace, allowing traversal characters and host overrides to alter the request target.

Attack Vector

The attack is delivered over the network through normal Grafana API or UI interactions. An authenticated Viewer issues a crafted query referencing a Tempo or Loki resource whose identifier contains traversal sequences. The backend plugin appends datasource secrets and dispatches the request to the manipulated path, returning the response body to the attacker.

No exploitation code is provided in the published advisory. Refer to the Grafana Security Advisory for the technical write-up.

Detection Methods for CVE-2026-10601

Indicators of Compromise

Outbound HTTP requests from Grafana to unexpected external hosts originating from the Tempo or Loki datasource plugin processes.
Tempo access logs showing hits on /flush or /shutdown endpoints sourced from the Grafana backend.
Loki CallResource invocations with URL parameters containing ../, %2e%2e%2f, or absolute URL prefixes.
Viewer-role accounts issuing high volumes of datasource queries with abnormal resource identifiers.

Detection Strategies

Inspect Grafana plugin and proxy logs for query parameters containing path traversal sequences targeting Tempo or Loki resource endpoints.
Correlate Viewer-role session activity with outbound network connections from the Grafana host to non-allowlisted destinations.
Alert on any successful invocation of Tempo lifecycle endpoints such as /flush and /shutdown outside of scheduled maintenance.

Monitoring Recommendations

Forward Grafana, Tempo, and Loki access logs to centralized log analytics with retention sufficient for incident response.
Monitor egress traffic from observability infrastructure and restrict it to known backend dependencies.
Track changes to secureJsonData configurations and rotate any custom header credentials suspected of exposure.

How to Mitigate CVE-2026-10601

Immediate Actions Required

Upgrade the Grafana Tempo and Loki datasource plugins to the fixed versions listed in the Grafana Security Advisory.
Rotate any credentials, API keys, or custom header secrets configured in Tempo and Loki datasources, since Viewer-level users may have captured them.
Audit Grafana role assignments and remove Viewer access for users who do not require query capabilities against Tempo or Loki.

Patch Information

Grafana has issued a security advisory tracking the fix. Apply the patched plugin versions as documented in the Grafana Security Advisory. Verify that both the Tempo and Loki datasource components are updated, since each is independently affected.

Workarounds

Restrict network egress from the Grafana backend so that the Tempo and Loki plugins can only reach their intended upstream services.
Place Tempo administrative endpoints such as /flush and /shutdown behind a separate network segment that is unreachable from the Grafana proxy.
Limit the use of secureJsonData custom headers to values that can be revoked quickly, and prefer short-lived tokens over long-lived credentials.

bash

# Example egress restriction using iptables on the Grafana host
# Allow outbound traffic only to internal Tempo and Loki endpoints
iptables -A OUTPUT -p tcp -d tempo.internal.local --dport 3200 -j ACCEPT
iptables -A OUTPUT -p tcp -d loki.internal.local --dport 3100 -j ACCEPT
iptables -A OUTPUT -p tcp -m owner --uid-owner grafana -j REJECT