CVE-2026-10601 is a CWE-22 directory traversal vulnerability in Grafana OSS that allows users with Viewer permissions to exploit specially crafted requests targeting the Tempo and Loki data source plugins. This can result in accessing backend endpoints not intended for such users. The impact depends on backend configuration and can include exposure of data source credentials, leaking internal responses, or triggering administrative actions on the backend. The vulnerability affects multiple specific versions of Grafana OSS. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

The vulnerability allows a user with limited (Viewer) permissions to potentially access sensitive backend endpoints via the Tempo and Loki plugins. This can lead to exposure of data source credentials, leakage of internal backend responses, or unintended administrative actions. The impact is limited to the extent of backend configuration and the permissions of the user. The CVSS score of 5.4 reflects a medium severity with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting Viewer permissions or limiting access to Tempo and Loki data source plugins where possible. Monitor vendor channels for updates and apply patches promptly once available.