Pyroscope, an open-source continuous profiling database, supports Tencent Cloud Object Storage (COS) as a storage backend. When configured to use Tencent COS, a vulnerability exists that allows an attacker with direct access to the Pyroscope API to retrieve the secret_key configuration value in plaintext. This vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-201 (Insertion of Sensitive Information Into Sent Data). The issue is rated critical with a CVSS 3.1 score of 9.1 due to its network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. The vulnerability is addressed in Pyroscope versions 1.15.2+, 1.16.1+, and all 1.17.x versions. Vendor advisories from Red Hat confirm the vulnerability and recommend limiting API exposure as a mitigation.

An attacker who can access the Pyroscope API when Tencent COS is configured as the storage backend can extract the secret_key in plaintext, leading to sensitive information disclosure. This compromises the confidentiality of the secret_key, which could be used to access Tencent COS resources. The vulnerability does not impact integrity or availability directly. The CVSS score of 9.1 reflects the critical nature of this confidentiality breach.

A fix is available in Pyroscope versions 1.15.2 and later for the 1.15.x branch, 1.16.1 and later for the 1.16.x branch, and all 1.17.x versions. Users should upgrade to these fixed versions to remediate the vulnerability. Until upgrading, it is strongly recommended to limit network exposure of the Pyroscope API so that it is accessible only by trusted users or internal systems. This reduces the risk of unauthorized access to the secret_key via the API.