Every CVESearch/Get API key

CVE-2026-42129

Path traversal in the Loki data source plugin

7.7 HighFix available

CVE-2026-42129 is a high vulnerability (CVSS 7.7) in Grafana Oss, published June 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 39th percentile. Fixed in github.com/grafana/grafana 11.6.15.

What does this mean?
Severity
7.7 HighCVSS 3.1, CVE List
Exploit chance
0.44%EPSS, 39th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
11.6.15github.com/grafana/grafana +13 more

Description

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.44%Up 0.1 points since Jun 23, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
2.0.0-beta1 up to 11.6.15
11.6.15
github.com/grafana/grafana
Go
12.0.0 up to 12.2.9
12.2.9
github.com/grafana/grafana
Go
12.3.0 up to 12.3.7
12.3.7
github.com/grafana/grafana
Go
13.0.0 up to 13.0.2
13.0.2
github.com/grafana/grafana
Go
12.4.0 up to 12.4.4
12.4.4
github.com/grafana/grafana
Go
before 1.9.2-0.20260616075434-82ef13993059
1.9.2-0.20260616075434-82ef13993059
grafana
Alpine:v3.24
before 12.4.4-r0
12.4.4-r0
github.com/grafana/grafana
Go
2.0.0-beta1 and laterNone known
github.com/grafana/grafana
Go
12.0.0 and laterNone known
github.com/grafana/grafana
Go
12.3.0 and laterNone known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
13.0.0 and laterNone known
github.com/grafana/grafana
Go
12.4.0 and laterNone known
github.com/grafana/grafana
Go
All versionsNone known
github.com/grafana/grafana
Go
2.0.0-beta1+incompatible and laterNone known

What each source reports

CVE List Score used7.7

Path traversal in the Loki data source plugin

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Record
CVE-2026-42129
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-22, CWE-22
Updated
2026-11-02
EUVDEUVD-2026-382417.7

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Record
EUVD-2026-38241
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-f74p-cwhp-x2wx7.7

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.

Record
GHSA-f74p-cwhp-x2wx
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD7.7

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Record
CVE-2026-42129
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2026-421297.7

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Record
ALPINE-CVE-2026-42129
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-03
OSVGHSA-f74p-cwhp-x2wx7.7

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.

Record
GHSA-f74p-cwhp-x2wx
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVGO-2026-6544No score

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.

Record
GO-2026-6544
Updated
2026-11-02

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 11 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open