CVE-2026-21726: grafana loki Path Traversal
CVSS: 5.3v3.1MediumAnalyzed
AliasesCGA-2hpg-3v2w-xp83CGA-c8pf-r69r-5h46CGA-gq42-q538-2fg8CGA-m3c6-6gwp-42h8CGA-p7hj-v3jh-pp9fCGA-rvj4-r26v-mm9qCGA-wgrp-xf9q-2pf6CGA-x2m5-7h25-5xqwGHSA-497x-rrr9-68jpGO-2026-5115CGA-2444-j48h-2839CGA-27p2-f9jc-2687CGA-29fg-gq43-59xpCGA-29mh-3ph4-pr3fCGA-2fjc-4cjr-x736CGA-34cp-6jm8-xvhgCGA-3mhw-wqmg-rr92CGA-3mpr-vqwm-pwfwCGA-3rjr-cwhh-cq89CGA-44ph-954h-9p8mCGA-4rmp-ggh8-42v5CGA-4vhm-77fw-c8xcCGA-52qm-4p36-8mv6CGA-5934-fw6w-7g5xCGA-59w8-g459-m26vCGA-5c68-x8gp-ww5xCGA-5vv7-r5r6-wq6vCGA-5vwx-r7fq-9cfrCGA-6864-cr3g-qf56CGA-6r46-g78j-j4j3CGA-7fg2-xc2r-xgxfCGA-7m74-7xh3-gwr9CGA-834p-6vpc-qqhvCGA-87qp-7rjv-hq8pCGA-8f4p-mxh3-wg3cCGA-8fr8-wr5r-rf44CGA-8j8q-2vmv-mh5fCGA-9hhf-2v3m-xphvCGA-9jxm-q42g-f3j2CGA-9wf6-7jm7-88phCGA-c2c5-9w9m-g29fCGA-c63j-r75w-49hwCGA-cph8-8633-59vhCGA-cpw3-jv88-w797CGA-cxqq-vvx5-8c8cCGA-f2rc-4pj8-gwhwCGA-f4rf-p698-gp98CGA-fjfj-67c4-wxr3CGA-fprg-fjf5-phhxCGA-fqg6-23g2-68v7CGA-g7x8-mf5v-crpcCGA-h437-gc5r-vg46CGA-h75g-gwp5-8p49CGA-hc48-3mjv-mw4hCGA-hjhp-h38c-x9q9CGA-j7h6-xmwj-68j2CGA-j873-xqm4-m48hCGA-jf45-8hcx-9834CGA-jp23-p2qr-cm5qCGA-m2v8-r7m5-gvgrCGA-m78r-qgxr-c482CGA-p22r-qc24-2hqfCGA-p5m3-3vgf-2gf8CGA-ph57-7qw7-87q8CGA-ph83-hrp5-9qxjCGA-prhf-2j8q-ff7fCGA-pvpm-j56r-qm7rCGA-qfwg-w753-jw79CGA-qg63-rcpr-792fCGA-qgh3-7wqv-qrc2CGA-r373-227q-48cqCGA-rxcq-86w2-q892CGA-v78x-f72c-44r2CGA-w3w6-6prh-25rqCGA-w45p-xvp5-jw3xCGA-wfcg-4457-7vcgCGA-whjx-f762-67gwCGA-wjjr-c88j-78rhCGA-wmmg-54xf-jmvpCGA-x6m6-m4g4-fghw
Published 15-04-2026Last modified 27-08-2026
Vulnerability summary
CVE-2026-21726 is a medium (CVSS 5.3) Path Traversal vulnerability in grafana loki. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.7% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.41%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 15-04-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · GoEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
0.00 pp
From 0.41% on 19-09-2026
19-09-202619-10-2026
EPSS score0.41%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard39 products
- commercial-grafana-11.6< 11.6.16-r0
- commercial-grafana-12.1All versions (No fix recorded)
- commercial-grafana-12.2< 12.2.10-r0
- commercial-grafana-12.3< 12.3.8-r0
- commercial-grafana-12.4< 12.4.5-r0
Wolfi4 products
- grafana-12.3< 12.3.7-r0
- grafana-12.4< 12.4.4-r0
- grafana-13.0< 13.0.2-r0
- grafana-alloy< 1.15.1-r2
Github.com/grafana1 product
- lokiAll versions (No fix recorded)
Github.com/grafana/loki1 product
- v3< 3.6.4
Grafana1 product
- loki≥ 2.3.0, < 3.5.9 | < 3.6.4
5 vendors · 46 products
References
5 links
- github.com/grafana/lokiPACKAGE