CVE-2026-10601

MediumCVSS 4.3/10Last modified Oct 25, 2026

Description

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Grafana	Grafana OSS	>= 11.6.0, <= 11.6.14; >= 12.2.0, <= 12.2.8; >= 12.3.0, <= 12.3.6; >= 12.4.0, <= 12.4.3; >= 13.0.0, <= 13.0.1

References

https://grafana.com/security/security-advisories/cve-2026-10601Broken Link

Timeline

Published: Jun 22, 2026
Last modified: Oct 25, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1060105.3The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route an CVE-2026-1060139.8The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to CVE-2026-1060145.3The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hos CVE-2026-1060158.1The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate accou CVE-2026-1060169.8Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.CVE-2026-1060176.3Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage r CVE-2026-1060188.7Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass. This iss CVE-2026-1060198.8Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System CVE-2026-1060208.6Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows S CVE-2026-1060228.6Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Retri CVE-2026-106023NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Serv CVE-2026-1060255.3The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that update