Review reviewCritical

CVE-2025-41118

Grafana Pyroscope, Multicluster Global Hub 1.7.1, Multicluster Global Hub

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems. This vulnerability is fixed in versions: 1.15.x:...

CVSS: 9.1
EPSS: 0.41%
CISA KEV: Not listed
Published: 2026.04.16

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.41%

Technical severityCVSS 9.1

Vulnerability overview

Affected product and versions

Product: Grafana Pyroscope, Multicluster Global Hub 1.7.1, Multicluster Global Hub
Affected versions: >= 1.0.0 < 1.16.0, < 1.15.2, 1.16.0
Fixed versions: 1.15.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Grafana Pyroscope, Multicluster Global Hub 1.7.1, Multicluster Global Hub and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-201, CWE-732