What is CVE-2026-10601?

CVE-2026-10601 is a security advisory published by Grafana Labs Security. Path traversal in the Tempo and Loki data source plugins

Why does CVE-2026-10601 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by CVE-2026-10601?

CVE-2026-10601 affects 2 products, including: Tempo; Loki.

CVE-2026-10601Disclosed before NVD

Path traversal in the Tempo and Loki data source plugins

Vendor

Grafana Labs Security

Published

June 9, 2026

Last Modified

—

📋 Description

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend. Upgrade to a fixed version listed below.

🎯 Affected products2

Tempo
Loki

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-10601/