CVE-2026-10601: Grafana Remote Code Execution Vulnerability
MODERATE
Advisory Identifier:
GHSA-9493-h4f5-633x
Advisory Summary
CVE-2026-10601 is a MODERATE (CVSS 5.4) remote code execution vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Grafana libraries in the Go ecosystem. The issue involves path traversal in the tempo and loki data source plugins. Remediation is available by upgrading affected packages to version 1.9.2-0.20260616075434-82ef13993059.
CVE-2026-10601 at a Glance
CVE Identifier
CVE-2026-10601
GHSA Identifier
GHSA-9493-h4f5-633x
Severity
MODERATE
CVSS v3.1 Base Score
5.4
CWE Classification
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Product
Grafana
Package Ecosystem
Go
Published Date
Last Updated
Security Impact
CVSS: 5.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
Low (PR:L)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
None (C:N)
Integrity
Low (I:L)
Availability
Low (A:L)
How to Fix CVE-2026-10601
To remediate this vulnerability, upgrade all affected Grafana dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/grafana/grafana
fixed: Latest secure release
Upgrade github.com/grafana/grafana to Latest secure release
github.com/grafana/grafana
fixed: Latest secure release
Upgrade github.com/grafana/grafana to Latest secure release
github.com/grafana/grafana
fixed: 1.9.2-0.20260616075434-82ef13993059
Upgrade github.com/grafana/grafana to 1.9.2-0.20260616075434-82ef13993059
github.com/grafana/grafana
fixed: Latest secure release
Upgrade github.com/grafana/grafana to Latest secure release
github.com/grafana/grafana
fixed: Latest secure release
Upgrade github.com/grafana/grafana to Latest secure release
github.com/grafana/grafana
fixed: Latest secure release
Upgrade github.com/grafana/grafana to Latest secure release
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/grafana/grafanaHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-10601, inspect your project dependencies for Grafana:
inspect dependencies for github.com/grafana/grafanaAnalyze the terminal output to locate any version of Grafana in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.9.2-0.20260616075434-82ef13993059), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Grafana, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.
CVE-2026-10601 Affected Grafana Versions
6 component(s)
Fixed Versions:
1.9.2-0.20260616075434-82ef13993059
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/grafana/grafana
|
Go |
≥ 2.0.0-beta1
|
|
|
github.com/grafana/grafana
|
Go |
≥ 12.0.0
|
|
|
github.com/grafana/grafana
|
Go |
< 1.9.2-0.20260616075434-82ef13993059
|
1.9.2-0.20260616075434-82ef13993059
|
|
github.com/grafana/grafana
|
Go |
≥ 12.3.0
|
|
|
github.com/grafana/grafana
|
Go |
≥ 13.0.0
|
|
|
github.com/grafana/grafana
|
Go |
≥ 12.4.0
|
|
References
NVD — CVE-2026-10601
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10601
Grafana Source Repository
REPOSITORY
https://github.com/grafana/grafana/pull/125789
Security Fix Commit
FIX COMMIT
https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1
Security Fix Commit
FIX COMMIT
https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29
Security Fix Commit
FIX COMMIT
https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4
Security Fix Commit
FIX COMMIT
https://github.com/grafana/grafana/commit/d27d2eba9c509d16f214d290436a6ad0bd9c6c01
Security Fix Commit
FIX COMMIT
https://github.com/grafana/grafana/commit/dd5dc51681ff0133ddb2e206c2ea318713aeca16
Security Fix Commit
FIX COMMIT
https://github.com/grafana/grafana/commit/f70d3e480274a5dbd12006338c393f4b05d441ca
Grafana Source Repository
REPOSITORY
https://github.com/grafana/grafana
Grafana Release
RELEASE
https://github.com/grafana/grafana/releases/tag/v11.6.15
Grafana Release
RELEASE
https://github.com/grafana/grafana/releases/tag/v12.2.9
Grafana Release
RELEASE
https://github.com/grafana/grafana/releases/tag/v12.3.7
Grafana Release
RELEASE
https://github.com/grafana/grafana/releases/tag/v12.4.4
Grafana Release
RELEASE
https://github.com/grafana/grafana/releases/tag/v13.0.2
Grafana Security Information
SECURITY
https://grafana.com/security/security-advisories/cve-2026-10601
Frequently Asked Questions
What is CVE-2026-10601?
CVE-2026-10601 is a security vulnerability in Grafana involving Path traversal in the Tempo and Loki data source plugins under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Which Grafana versions are affected?
Affected versions include releases prior to 1.9.2-0.20260616075434-82ef13993059 across affected packages: github.com/grafana/grafana.
What version fixes CVE-2026-10601?
Upgrading to 1.9.2-0.20260616075434-82ef13993059 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/grafana/grafana affected?
Yes, github.com/grafana/grafana is affected in releases prior to Latest secure release, 1.9.2-0.20260616075434-82ef13993059. Upgrade your dependency to Latest secure release, 1.9.2-0.20260616075434-82ef13993059 or later.
What is the CVSS score of CVE-2026-10601?
CVE-2026-10601 has a CVSS v3.1 base score of 5.4 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
What CWE is associated with CVE-2026-10601?
CVE-2026-10601 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).
How can I check Go dependencies for CVE-2026-10601?
Run the dependency tree command: 'inspect dependencies for github.com/grafana/grafana'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-9493-h4f5-633x",
"modified" : "2026-09-21T23:03:34Z",
"published" : "2026-06-22T15:30:43Z",
"aliases" : [ "CVE-2026-10601" ],
"summary" : "Grafana: Path traversal in the Tempo and Loki data source plugins",
"details" : "The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/grafana/grafana"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0-beta1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 11.6.15"
}
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/grafana/grafana"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "12.0.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 12.2.9"
}
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/grafana/grafana"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "12.3.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 12.3.7"
}
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/grafana/grafana"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "13.0.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 13.0.2"
}
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/grafana/grafana"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "12.4.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 12.4.4"
}
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/grafana/grafana"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.9.2-0.20260616075434-82ef13993059"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-10601"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/pull/125789"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/d27d2eba9c509d16f214d290436a6ad0bd9c6c01"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/dd5dc51681ff0133ddb2e206c2ea318713aeca16"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/f70d3e480274a5dbd12006338c393f4b05d441ca"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/grafana/grafana"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/releases/tag/v11.6.15"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/releases/tag/v12.2.9"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/releases/tag/v12.3.7"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/releases/tag/v12.4.4"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/releases/tag/v13.0.2"
}, {
"type" : "WEB",
"url" : "https://grafana.com/security/security-advisories/cve-2026-10601"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-09-21T23:03:34Z",
"nvd_published_at" : "2026-06-22T14:16:25Z"
}
}