Pyroscope versions configured to use Tencent COS as a storage backend expose the secret_key configuration via the Pyroscope API if accessed by an attacker. This exposure requires the attacker to have direct API access. The vulnerability allows extraction of sensitive secret_key credentials, potentially compromising the confidentiality and integrity of the system. Fixed versions are 1.15.2 and above for 1.15.x, 1.16.1 and above for 1.16.x, and all 1.17.x versions starting from 1.17.0. The CVSS 3.1 score is 9.1 (critical), with attack vector network, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.

An attacker with direct access to the Pyroscope API can extract the secret_key configuration value when Tencent COS is used as the storage backend. This leads to a high confidentiality and integrity impact, as the secret_key could be used to compromise the storage backend or related systems. There is no reported impact on availability. No known exploits in the wild have been reported.

Upgrade Pyroscope to version 1.15.2 or later for the 1.15.x series, 1.16.1 or later for the 1.16.x series, or 1.17.0 or later for the 1.17.x series to remediate this vulnerability. Additionally, limit public internet exposure of the Pyroscope API to trusted users or internal systems to reduce the risk of exploitation. Patch status is confirmed by the vendor's advisory indicating fixed versions.