Skip to content
Fencer Vulns
critical 9.1

CVE-2025-41118 json

Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection

published 2026-04-15 6 mo ago modified 2026-10-07 33 d ago also BIT-grafana-pyroscope-2025-41118 , EUVD-2025-209489 , GHSA-m9hq-h476-h2g8 , GO-2026-5501

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS).

If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API.

To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems.

This vulnerability is fixed in versions:

1.15.x: 1.15.2 and above. 1.16.x: 1.16.1 and above. 1.17.x: 1.17.0 and above (i.e. all versions).

Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.

Patch / fix

  • go github.com/grafana/pyroscope 1.15.2, 1.16.1
  • bitnami grafana-pyroscope 1.15.2, 1.17.0
  • Grafana Pyroscope 1.16.0
  • Red Hat Multicluster Global Hub 1.7.0 1779925273
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-41118 updated cvss 7.5

pyroscope: sensitive COS SecretKey exposed in plaintext via configuration API due to missing type protection

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9 Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9
    affected: workaround, no fix available “To mitigate this vulnerability, limit network exposure of the Pyroscope API so it is only accessible by trusted users on the internal network.”
  • Red Hat Multicluster Global Hub 1.7.3 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779925273
    fixed: vendor fix “To mitigate this vulnerability, limit network exposure of the Pyroscope API so it is only accessible by trusted users on the internal network.” RHSA-2026:24503
  • Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel8 Red Hat Multicluster Global Hub 1.7.3 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1780361828, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1780615638, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779887500, multicluster-globalhub/multicluster-globalhub-operator-bundle 1780616828, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779815431 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
6 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/grafana/pyroscope
<1.15.2
>=1.16.0, <1.16.1
1.15.2
1.16.1
bitnami grafana-pyroscope
<1.15.2
>=1.16.0, <1.17.0
1.15.2
1.17.0

Affected products

  • Grafana Pyroscope
  • Red Hat Multicluster Global Hub 1.7.0
  • Red Hat Multicluster Global Hub
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Ceph Storage 5
  • Red Hat Red Hat Ceph Storage 6
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource
  • CWE-201 Insertion of Sensitive Information Into Sent Data
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.