Vulnerability Report

CVE-2025-41118

Title: Pyroscope Tencent COS Secret Key Disclosure

Information Disclosure

Proof Of Concept

No public PoC currently indexed for CVE-2025-41118.

CWE Category NVD-CWE-noinfo

Published Date Apr 15, 2026

Modified Date Jul 20, 2026

Exploit Status Not Found

Score 9.1 CVSS v3.1

Exploit Probability (EPSS)

0.41%

Vulnerability Summary

CVE-2025-41118: Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems. This vulnerability is fixed in versions: 1.15.x: 1.15.2 and above. 1.16.x: 1.16.1 and above. 1.17.x: 1.17.0 and above (i.e. all versions). Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.

Impacted Vendors

grafana 1

Reference Links

https://grafana.com/security/security-advisories/cve-2025-41118

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N