CVE-2025-41118

Katalog CVE

CVSS 9.1 · Critical EPSS 0,41%

Kerentanan Incorrect Permission Assignment for Critical Resource pada grafana pyroscope. Skor CVSS 3.1 9.1 (Critical) menurut grafana.com.

Deskripsi (NVD)

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems. This vulnerability is fixed in versions: 1.15.x: 1.15.2 and above. 1.16.x: 1.16.1 and above. 1.17.x: 1.17.0 and above (i.e. all versions). Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber grafana.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-201: Insertion of Sensitive Information Into Sent Data

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://grafana.com/security/security-advisories/cve-2025-41118 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:24503
• https://access.redhat.com/security/cve/CVE-2025-41118
• https://bugzilla.redhat.com/show_bug.cgi?id=2458796
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-41118.json