Grafana Loki vulnerabilities

3 vulnerabilities

Known vulnerabilities in Grafana Loki, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2021-36156github.com/grafanaloki+1
EPSS score
1.48%
An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.5.3CVE-2026-21726chainguardcommercial-grafana-11.6+45
EPSS score
0.41%
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.7.5CVE-2026-21729grafanaloki
EPSS score
0.46%
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.