Detections
Analytics
SCA: security update for github.com/grafana/pyroscope (GHSA-m9hq-h476-h2g8)
high Tenable Cloud Security Plugin ID 440926
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Pyroscope is an open-source continuous profiling database. The database supports various storage backends,
including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the
storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To
exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend
limiting the public internet exposure of all our databases, such that they are only accessible by trusted
users or internal systems. This vulnerability is fixed in versions: 1.15.x: 1.15.2 and above. 1.16.x:
1.16.1 and above. 1.17.x: 1.17.0 and above (i.e. all versions). Thanks to Théo Cusnir for reporting this
vulnerability to us via our bug bounty program. (CVE-2025-41118)
Solution
Update the github.com/grafana/pyroscope library and its related packages to version 1.15.2 or later.See Also
Plugin Details
Severity: High
ID: 440926
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 4/27/2026
Updated: 6/30/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.16
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 9.4
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N
CVSS Score Source: CVE-2025-41118
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 4/15/2026
Vulnerability Publication Date: 4/15/2026
Reference Information
CVE: CVE-2025-41118