CRITICAL🇵🇱 Wersja polska

CVE-2025-41118

CVSS 9.1v3.1pub. 2026-04-15upd. 2026-06-30

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems. This vulnerability is fixed in versions: 1.15.x: 1.15.2 and above. 1.16.x: 1.16.1 and above. 1.17.x: 1.17.0 and above (i.e. all versions). Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Grafana Pyroscope

    APP
    Grafana
    1.16.0< 1.15.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-39226CRITICAL9.8⚠ KEVten sam vendor

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated ...

CVE-2026-28381CRITICAL9.6PL ✓ten sam vendor

Nieautoryzowany odczyt/zapis plików przez Snowflake datasource w Grafana

CVE-2026-27876CRITICAL9.1PL ✓ten sam vendor

RCE w Grafana przez SQL Expressions i plugin Enterprise (CVE-2026-27876)

CVE-2025-41115CRITICAL10.0PL ✓ten sam vendor

Grafana Enterprise: privilege escalation przez SCIM provisioning (LPE)

CVE-2024-9264CRITICAL9.4PL ✓ten sam vendor

Grafana: command injection i local file inclusion przez SQL Expressions (duckdb)