CVE-2025-41118: Grafana Pyroscope information disclosure in Tencent COS configuration API

CVE-2025-41118 · Severity: critical · CVSS 9.1 · Published 2026-04-15

Pyroscope, an open-source tool used for monitoring application performance, contains a security flaw when using Tencent Cloud Object Storage (COS) as its storage backend. An attacker with access to the Pyroscope API can retrieve the secret key used to access the cloud storage. This could allow an unauthorized party to access, modify, or delete sensitive performance data stored in the cloud.

Technologies: Red Hat Multicluster Global Hub. Vendors: Go, Red Hat.

Quick answers

Is CVE-2025-41118 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-41118 being exploited in the wild.
How severe is CVE-2025-41118?
Critical severity, with a CVSS score of 9.1, published 15 April 2026.
Which products and versions are affected?
github.com/grafana/pyroscope (Go) SEMVER:introduced=0,fixed=1.15.2, SEMVER:introduced=0,fixed=1.15.2,introduced=1.16.0,fixed=1.16.1; Red Hat Multicluster Global Hub 1.7::el9.
Is there a fix for CVE-2025-41118?
Yes. github.com/grafana/pyroscope (Go): upgrade to 1.15.2, 1.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-41118 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-41118?
Check whether you run github.com/grafana/pyroscope (Go) or Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/grafana/pyroscope (Go): upgrade to 1.15.2, 1.16.1 or later
    go get github.com/grafana/pyroscope@v1.16.1

Technical details

A vulnerability in Grafana Pyroscope (CWE-201/CWE-732) occurs when the database is configured to use Tencent Cloud Object Storage (COS) as a backend. The application fails to protect the 'secret_key' configuration value, exposing it in plaintext through the Pyroscope configuration API. An unauthenticated attacker with network access to the API can extract these credentials. This issue is fixed in versions 1.15.2, 1.16.1, and all versions from 1.17.0 onwards. Red Hat products incorporating Pyroscope, such as Multicluster Global Hub and Ceph Storage 6, are also impacted.

Affected products

  • Grafana Labs Pyroscope < 1.15.2, 1.16.0
  • Red Hat Multicluster Global Hub 1.7.1 1.7::el9
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 2
  • Red Hat Red Hat Ceph Storage 6 6

Identifiers

  • CVE-2025-41118
  • GHSA-m9hq-h476-h2g8
  • GO-2026-5501

Timeline

  • 2025-01-01: disclosed: Initial release date listed in Red Hat VEX
  • 2026-01-02: advisory: Grafana Labs advisory published
  • 2026-04-15: advisory: NVD publication date
  • 2026-06-08: patched: Red Hat security update issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.