The vulnerability in Grafana Pyroscope allows an attacker with direct access to the Pyroscope API to extract the secret_key configuration value if Tencent COS is used as the storage backend. This exposure of sensitive credentials can lead to unauthorized access to storage resources. The issue affects versions prior to 1.15.2 for the 1.15.x series, prior to 1.16.1 for the 1.16.x series, and all versions before 1.17.0 in the 1.17.x series. The vulnerability is rated critical with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating network exploitable with no privileges or user interaction required, causing high confidentiality and integrity impact but no availability impact. The vendor has released fixed versions to address this issue.

An attacker who can directly access the Pyroscope API and if the system is configured to use Tencent COS as the storage backend can extract the secret_key configuration value. This compromises the confidentiality and integrity of the secret_key, potentially allowing unauthorized access or manipulation of storage resources. The vulnerability does not impact availability. The CVSS score of 9.1 reflects critical severity due to the ease of exploitation and high impact on confidentiality and integrity.

A fix is available in Pyroscope versions 1.15.2 and above for the 1.15.x series, 1.16.1 and above for the 1.16.x series, and all 1.17.x versions starting from 1.17.0. Users should upgrade to these fixed versions to remediate the vulnerability. Additionally, it is highly recommended to limit public internet exposure of the Pyroscope API to trusted users or internal systems only, reducing the attack surface. Patch status is confirmed by the vendor advisory.