CVE-2025-41118: grafana pyroscope

Vulnerability summary

CVE-2025-41118 is a critical (CVSS 9.1) vulnerability in grafana pyroscope. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.5% of scored vulnerabilities.

Timeline

1. 15-04-2026
   PublishedVulnerability first disclosed.
2. 27-08-2026
   Last modifiedVulnerability information updated.

Description

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems. This vulnerability is fixed in versions: 1.15.x: 1.15.2 and above. 1.16.x: 1.16.1 and above. 1.17.x: 1.17.0 and above (i.e. all versions). Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.

• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
• CWE-201Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.