Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2025-41118: Pyroscope Database Leaks Tencent Cloud Storage Secrets
CVE-2025-41118 · published 6 months ago
Summary
If your Pyroscope database uses Tencent Cloud Storage, an attacker with access to the database's API could steal sensitive configuration keys. To fix this, update your Pyroscope to version 1.15.2 or higher, 1.16.1 or higher, or 1.17.0 or higher. Limit public access to your database to prevent unauthorized access.
What to do
- Update github.com grafana to version 1.15.2.
- Update github.com grafana to version 1.16.1.
- Update grafana-pyroscope to version 1.17.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | grafana |
< 1.15.2 >= 1.16.0, < 1.16.1 Fix: upgrade to 1.15.2
|
| Bitnami | – | grafana-pyroscope |
>= 1.16.0, < 1.17.0 Fix: upgrade to 1.17.0
|
| – | grafana | pyroscope |
< 1.16.0 < 1.15.2 1.16.0 |
Original advisory text
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS).
If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API.
To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems.
This vulnerability is fixed in versions:
1.15.x: 1.15.2 and above.
1.16.x: 1.16.1 and above.
1.17.x: 1.17.0 and above (i.e. all versions).
Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.
If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API.
To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems.
This vulnerability is fixed in versions:
1.15.x: 1.15.2 and above.
1.16.x: 1.16.1 and above.
1.17.x: 1.17.0 and above (i.e. all versions).
Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.
References
- https://grafana.com/security/security-advisories/cve-2025-41118 Vendor Advisory
- https://github.com/advisories/GHSA-m9hq-h476-h2g8
- https://nvd.nist.gov/vuln/detail/CVE-2025-41118 Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-41118.json URL
- https://access.redhat.com/errata/RHSA-2026:24503 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-41118 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2458796 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/41xxx/CVE-2025-41118... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-200Information Exposure
CWE-732Incorrect Permission Assignment for Critical Resource
CWE-201Insertion of Sensitive Information Into Sent Data
Timeline
Published15 Apr 2026
Updated4 Nov 2026
First seen15 Apr 2026
Track software like this
Free during beta