Secuno
ENNL
Book demo

CVE-2025-41118

Grafana Pyroscope vulnerability

9.1 CRITICALEPSS 0.41%
  1. Published15 Apr 2026

Description

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems. This vulnerability is fixed in versions: 1.15.x: 1.15.2 and above. 1.16.x: 1.16.1 and above. 1.17.x: 1.17.0 and above (i.e. all versions). Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Grafana Pyroscope< 1.15.2 · 1.16.0

Remediation

Fixed in
Grafana Pyroscope≥ 1.15.2

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1078148.4
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until…
CVE-2026-925559.8
Insertion of sensitive information into sent data vulnerability in AKIN Software…
CVE-2026-1065019.6
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1,…
CVE-2026-1052678.1
The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires…
CVE-2026-863618.2
Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission…
CVE-2026-393539.1
InvoicePlane is a self-hosted open source application for managing invoices, clients,…

Frequently asked

Is CVE-2025-41118 being actively exploited?

CVE-2025-41118 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.41%.

How severe is CVE-2025-41118?

CVE-2025-41118 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.41% probability of exploitation.

Which products are affected by CVE-2025-41118?

Affected products include Grafana Pyroscope.

How do I fix CVE-2025-41118?

Upgrade affected software to a fixed version, for example Grafana Pyroscope 1.15.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-41118 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.