CVE-2025-41118
Pyroscope, an open-source continuous profiling database, can expose the secret_key used for Tencent Cloud Object Storage when the database is configured to use that backend. An attacker who can reach the Pyroscope API can read this key, potentially accessing the cloud storage. The issue is fixed in newer releases of Pyroscope.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Grafana Pyroscope, including versions 1.15.x, 1.16.x, and 1.17.x. The vulnerability affects deployments configured to use Tencent Cloud Object Storage as the storage backend. The affected version 1.16.0 is explicitly listed.
Real-world impact
An attacker who can reach the Pyroscope API can read the secret_key used to access Tencent COS, giving them the ability to read, modify, or delete data stored in the cloud bucket. This could lead to loss of data confidentiality and integrity.
Why this severity
The CVSS score of 9.1 reflects that the flaw is exploitable over the network without authentication or user interaction, and it allows full compromise of confidentiality and integrity of the data stored in the backend.
What to do about it
- 01Upgrade Pyroscope to a fixed version: 1.15.2 or newer, 1.16.1 or newer, or 1.17.0 or newer.
- 02Restart the Pyroscope service to apply the update.
- ›Limit public internet exposure of the Pyroscope API so that it is only accessible by trusted users or internal systems.
NVD-referenced vendor advisory
Timeline
- Apr 15, 2026 · Apr 15, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 16d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Aug 3, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.