The vulnerability in Grafana Pyroscope affects instances configured to use Tencent COS as the storage backend. An attacker with direct API access can retrieve the secret_key configuration value, exposing sensitive credentials. Exploitation requires direct access to the Pyroscope API, which should be restricted to trusted users or internal systems. The issue is addressed in Pyroscope versions 1.15.2+, 1.16.1+, and all 1.17.x releases. The CVSS v3.1 score is 9.1 (critical), reflecting high confidentiality and integrity impact with no required privileges or user interaction.

Successful exploitation results in disclosure of the secret_key used for Tencent COS storage backend, compromising confidentiality and integrity of the system. This could enable unauthorized access to storage resources or further attacks leveraging the exposed credentials. There is no impact on availability reported. The vulnerability requires direct API access, limiting exposure to environments where the API is publicly accessible or insufficiently protected.

A fix is available in Pyroscope versions 1.15.2 and later for the 1.15.x branch, 1.16.1 and later for the 1.16.x branch, and all 1.17.x versions. Users should upgrade to these versions to remediate the vulnerability. Additionally, it is strongly recommended to restrict access to the Pyroscope API to trusted users or internal systems only, avoiding public internet exposure. Patch status is confirmed by vendor advisories from Red Hat. No other mitigations are specifically indicated.