Every CVE Search/ Get API key

CVE-2026-42129

Path traversal in the Loki data source plugin

7.7 HighFix available

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.44%Up 0.1 points since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

Path traversal in the Loki data source plugin

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Record
CVE-2026-42129
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-22, CWE-22
Updated
2026-11-02
EUVDEUVD-2026-38241 7.7

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Record
EUVD-2026-38241
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-f74p-cwhp-x2wx 7.7

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.

Record
GHSA-f74p-cwhp-x2wx
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 7.7

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Record
CVE-2026-42129
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2026-42129 7.7

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Record
ALPINE-CVE-2026-42129
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-03
OSVGHSA-f74p-cwhp-x2wx 7.7

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.

Record
GHSA-f74p-cwhp-x2wx
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVGO-2026-6544 No score

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.

Record
GO-2026-6544
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 2.0.0-beta1 up to 11.6.15
11.6.15
github.com/grafana/grafana
Go
 12.0.0 up to 12.2.9
12.2.9
github.com/grafana/grafana
Go
 12.3.0 up to 12.3.7
12.3.7
github.com/grafana/grafana
Go
 13.0.0 up to 13.0.2
13.0.2
github.com/grafana/grafana
Go
 12.4.0 up to 12.4.4
12.4.4
github.com/grafana/grafana
Go
 before 1.9.2-0.20260616075434-82ef13993059
1.9.2-0.20260616075434-82ef13993059
grafana
Alpine:v3.24
 before 12.4.4-r0
12.4.4-r0
github.com/grafana/grafana
Go
 2.0.0-beta1 and later None known
github.com/grafana/grafana
Go
 12.0.0 and later None known
github.com/grafana/grafana
Go
 12.3.0 and later None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 13.0.0 and later None known
github.com/grafana/grafana
Go
 12.4.0 and later None known
github.com/grafana/grafana
Go
 All versions None known
github.com/grafana/grafana
Go
 2.0.0-beta1+incompatible and later None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42129 is a high vulnerability (CVSS 7.7) in Grafana Oss, published June 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in github.com/grafana/grafana 11.6.15.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open