VDB
Sign up
MEDIUM5.4

GHSA-9493-h4f5-633x

Grafana: Path traversal in the Tempo and Loki data source plugins

Quick fix

GHSA-9493-h4f5-633x — github.com/grafana/grafana: upgrade to the fixed version with the command below.

go get github.com/grafana/grafana@v1.9.2-0.20260616075434-82ef13993059

Details

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/grafana/grafana
Introduced in: 2.0.0-beta1

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.0.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.3.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 13.0.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.4.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 0Fixed in: 1.9.2-0.20260616075434-82ef13993059
Fixgo get github.com/grafana/grafana@v1.9.2-0.20260616075434-82ef13993059

References