CVE-2025-41118

pyroscope: sensitive COS SecretKey exposed in plaintext via configuration API due to missing type protection

Loading…

Severity

Important

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · April 16, 2026

Updated · September 22, 2026

Description

A flaw was found in Pyroscope. When Tencent Cloud Object Storage (COS) is configured as the storage backend, an attacker with access to the Pyroscope API can extract the secret_key value in plaintext. This issue leads to sensitive information disclosure.

Statement

This flaw allows an attacker with direct access to the Pyroscope API to extract the Tencent Cloud Object Storage (COS) secret_key in plaintext when COS is configured as the storage backend. Due to this reason, this vulnerability has been rated with an important severity.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

To mitigate this vulnerability, limit network exposure of the Pyroscope API so it is only accessible by trusted users on the internal network.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-201 · Insertion of Sensitive Information Into Sent Data