| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/grafana/grafana | ≥ 12.0.0≥ 12.3.0≥ 12.4.0≥ 13.0.0≥ 2.0.0-beta1≥ 2.0.0-beta1+incompatible< 1.9.2-0.20260616075434-82ef13993059all versions | 1.9.2-0.20260616075434-82ef13993059 |
| grafana | = 11.6.0 |
The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free