Critical severity · published Apr 15, 2026
CVE-2025-41118
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS).
If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API.
To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems.
This vulnerability is fixed in versions:
1.15.x: 1.15.2 and above.
1.16.x: 1.16.1 and above.
1.17.x: 1.17.0 and above (i.e. all versions).
Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
1.0.0 before 1.16.0 · source: vendor
PY
Pyroscope · Grafana
before 1.15.2; 1.16.0 · source: NVD
MG
Multicluster Global Hub 1.7.0 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Advanced Cluster Management for Kubernetes 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ceph Storage 6 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-41118
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-41118
Vendor Advisory
https://grafana.com/security/security-advisories/cve-2025-41118
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:24503
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-41118
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2458796
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-41118.json
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.8
CVE-2025-41115
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user…
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim
9.8
CVE-2022-28660
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used