CVE-2025-41118

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

CVE-2025-41118 Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

CVE-2025-41118

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

CVE-2025-41118 Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

CVE-2025-41118: Incorrect Permission Assignment for Critical Resource

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

Pyroscope 安全漏洞

Pyroscope is an open-source continuous performance analysis platform developed by Grafana. Vulnerabilities exist in versions prior to Pyroscope 1.15.2, 1.16.1, and 1.17.0. These vulnerabilities stem from improper configuration, potentially allowing attackers to extract the secretkey configuration...

GHSA-78H2-9FRX-2JM8 vulnerabilities

Vulnerabilities for packages: harbor-registry, velero-fips, cloudbeat, kubescape-server, image-factory, ratify-fips, gitlab-runner-fips, crossplane, cert-manager-istio-csr, apko, peerdb-flow, vault-secrets-webhook, external-secrets-fips, sftpgo, xeol, opentelemetry-collector-contrib,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: maru, crossplane-provider-aws-route53, atlantis, nri-postgresql, amass, langfuse, migrate, gitleaks, telegraf, tailscale, overmind, timoni, ratify, pguser, litestream, rabbitmq-cluster-operator, cerbos, nri-discovery-kubernetes, spegel, knative-operator, containerd,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: maru, crossplane-provider-aws-route53, atlantis, nri-postgresql, amass, langfuse, migrate, gitleaks, telegraf, tailscale, timoni, ratify, pguser, litestream, rabbitmq-cluster-operator, cerbos, nri-discovery-kubernetes, spegel, kubecolor, knative-operator, containerd,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: maru, crossplane-provider-aws-route53, atlantis, nri-postgresql, amass, langfuse, migrate, gitleaks, telegraf, tailscale, timoni, ratify, pguser, litestream, rabbitmq-cluster-operator, cerbos, nri-discovery-kubernetes, spegel, kubecolor, knative-operator, containerd,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, podinfo, authservice, crossplane-provider-aws-route53, atlantis, flux-source-controller, kubernetes-csi-external-health-monitor, dkron, cilium-envoy, crossplane-provider-aws-kms, spicedb, kafka-proxy, secrets-store-csi-driver-provider-aw...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: flux-notification-controller, podinfo, authservice, crossplane-provider-aws-route53, atlantis, flux-source-controller, kubernetes-csi-external-health-monitor, dkron, cilium-envoy, crossplane-provider-aws-kms, spicedb, kafka-proxy, secrets-store-csi-driver-provider-aw...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: prometheus-stackdriver-exporter, crossplane-provider-kubernetes-fips, pulumi-kubernetes-operator, k8ssandra-operator-fips, smarter-device-manager, terraform-provider-azurerm-fips, crossplane-provider-aws-kinesis, cloudbeat, kubescape-server, sftpgo-plugin-geoipfilter...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: kube-bench, kubelet-csr-approver-fips, crossplane-provider-kubernetes-fips, prometheus-stackdriver-exporter, k8ssandra-operator-fips, pulumi-kubernetes-operator, smarter-device-manager, kube-mgmt, crossplane-provider-aws-kinesis, nri-apache,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: kube-bench, kubelet-csr-approver-fips, crossplane-provider-kubernetes-fips, prometheus-stackdriver-exporter, k8ssandra-operator-fips, pulumi-kubernetes-operator, smarter-device-manager, kube-mgmt, crossplane-provider-aws-kinesis, nri-apache,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: kube-bench, kubelet-csr-approver-fips, crossplane-provider-kubernetes-fips, prometheus-stackdriver-exporter, k8ssandra-operator-fips, pulumi-kubernetes-operator, smarter-device-manager, kube-mgmt, crossplane-provider-aws-kinesis, nri-apache,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, velero-fips, buildkitd, cloudbeat, kubescape-server, cluster-api-provider-vsphere-fips, ratify-fips, gitlab-runner-fips, cass-operator-fips, ferretdb, gcp-compute-persistent-disk-csi-driver-fips, vault-secrets-webhook, sftpgo,...

The vulnerability of Grafana Pyroscope’s continuous profiling software relates to the disclosure of information, which allows a perpetrator to access confidential data.

The vulnerability of Grafana Pyroscope’s continuous profiling software is related to the exposure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

PT-2026-3780

Name of the Vulnerable Software and Affected Versions Pyroscope versions prior to 1.15.2 Pyroscope versions prior to 1.16.1 Description When configured to use Tencent Cloud Object Storage COS as the storage backend, the Pyroscope API may expose the secret key configuration value. An attacker with...

Exposure of Storage Secret in Pyroscope

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...