CVE-2025-41118

OVERVIEW CVE-2025-41118 is a credential exposure vulnerability in Pyroscope, an open-source continuous profiling database. The flaw allows attackers to extract the Tencent Cloud Object Storage (COS) secret_key configuration value through the Pyroscope API when the database is configured to use Tencent COS as its storage backend. The vulnerability affects Pyroscope versions prior to 1.15.2, 1.16.1, and 1.17.0. SEVERITY This vulnerability carries a CRITICAL CVSS score of 9.1 with a network-based attack vector, requiring no authentication or user interaction. The attack is trivially exploitable with low complexity, leading to complete compromise of confidentiality and integrity of stored profiling data and cloud storage credentials. Successful exploitation enables attackers to access sensitive configuration secrets that could facilitate further cloud infrastructure compromise. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities (KEV) catalog and inactive Hot List status. The EPSS score of 0.00041 suggests minimal current exploitation probability. However, organizations should prioritize patching as the attack requires only direct API access without authentication, and the exposure of cloud storage credentials poses significant downstream risk regardless of current exploitation activity.