PT-2026-3780 · Pyroscope · Pyroscope

Published 2026-01-02 · Updated 2026-04-21 · CVE-2025-41118

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Pyroscope versions prior to 1.15.2 Pyroscope versions prior to 1.16.1

Description When configured to use Tencent Cloud Object Storage (COS) as the storage backend, the Pyroscope API may expose the secret key configuration value. An attacker with direct access to the API can extract this sensitive information.

Recommendations Update to version 1.15.2 or above. Update to version 1.16.1 or above. Limit public internet exposure of the database to ensure it is only accessible by trusted users or internal systems.

Fix

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

BDU:2026-00669

BIT-GRAFANA-PYROSCOPE-2025-41118

CVE-2025-41118

GHSA-M9HQ-H476-H2G8

Affected Products

Pyroscope

References · 10

• https://osv.dev/vulnerability/GHSA-m9hq-h476-h2g8 · Vendor Advisory
• https://grafana.com/security/security-advisories/cve-2025-41118 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00669 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-41118 · Security Note
• https://osv.dev/vulnerability/BIT-grafana-pyroscope-2025-41118 · Vendor Advisory
• https://github.com/grafana/pyroscope · Note
• https://twitter.com/pulsepatchio/status/2045335947953217794 · Twitter Post
• https://twitter.com/CVEnew/status/2044701625093399025 · Twitter Post
• https://twitter.com/0dayPublishing/status/2046305354305146978 · Twitter Post
• https://twitter.com/ptdbugs/status/2044725975754183146 · Twitter Post