CVE-2026-10601: Grafana: dizin geçişi

Açıklama (NVD)

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Özet bilgiler

Ürün

Grafana Grafana

CVSS v3.1

4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

%0,29 (yüzdelik 21)

CWE

CWE-22

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• grafana.com
• CWE-22