CVE-2025-41118 - Vulnerability Analysis

Overview

Pyroscope < 1.15.2, < 1.16.1, and < 1.17.0 contains an information disclosure vulnerability caused by exposure of secret_key configuration via the API when using Tencent COS storage backend, letting attackers with direct API access extract secret keys.

Severity & Score

Impact

Attackers with direct API access can extract secret keys, potentially compromising storage backend security and data confidentiality.

Mitigation

Upgrade to versions 1.15.2, 1.16.1, 1.17.0 or later.

References

• https://grafana.com/security/security-advisories/cve-2025-41118

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 17, 2026

🔴 CVE-2025-41118 - Critical (9.1) Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could ex... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41118/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner