{"id":"CVE-2026-42129","aliases":["ALPINE-CVE-2026-42129","EUVD-2026-38241","GHSA-f74p-cwhp-x2wx","GO-2026-6544"],"status":"published","title":"Path traversal in the Loki data source plugin","description":"A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00443,"percentile":0.38928,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-06-22T13:18:27Z","modified":"2026-11-03T06:33:02Z","fixes":[{"ecosystem":"Go","package":"github.com/grafana/grafana","fixed_in":["11.6.15","12.2.9","12.3.7","13.0.2","12.4.4","1.9.2-0.20260616075434-82ef13993059"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["12.4.4-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta1"},{"fixed":"11.6.15"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.2.9"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.3.0"},{"fixed":"12.3.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.4.0"},{"fixed":"12.4.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-0.20260616075434-82ef13993059"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.4-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-beta1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"12.3.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"12.4.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.2-0.20260616075434-82ef13993059"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-beta1+incompatible"}]}]}],"products":[{"vendor":"grafana","product":"grafana oss"},{"vendor":"grafana","product":"loki_datasource"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-42129","tags":["vendor-advisory","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42129","tags":["advisory"]},{"url":"https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/d27d2eba9c509d16f214d290436a6ad0bd9c6c01","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/dd5dc51681ff0133ddb2e206c2ea318713aeca16","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/eeb08ceb020c4381242d8400e5878044e9877505","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/f70d3e480274a5dbd12006338c393f4b05d441ca","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/releases/tag/v11.6.15","tags":["web"]},{"url":"https://github.com/grafana/grafana/releases/tag/v12.2.9","tags":["web"]},{"url":"https://github.com/grafana/grafana/releases/tag/v12.3.7","tags":["web"]},{"url":"https://github.com/grafana/grafana/releases/tag/v12.4.4","tags":["web"]},{"url":"https://github.com/grafana/grafana/releases/tag/v13.0.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f74p-cwhp-x2wx","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42129","tags":["advisory"]},{"url":"https://github.com/grafana/grafana","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42129","title":"Path traversal in the Loki data source plugin","description":"A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.","status":"published","published":"2026-06-22T13:18:27.365Z","modified":"2026-08-27T17:22:32.86Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-22"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-38241","description":"A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.","status":"published","published":"2026-06-22T13:18:27Z","modified":"2026-08-27T17:22:32Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-f74p-cwhp-x2wx","title":"Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.","description":"The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.","status":"published","published":"2026-06-22T15:30:43Z","modified":"2026-09-21T22:54:45Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:19.455935Z"}],"nvd":[{"id":"CVE-2026-42129","description":"A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.","status":"published","published":"2026-06-22T14:17:36.34Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"ALPINE-CVE-2026-42129","description":"A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.","status":"published","published":"2026-06-22T14:17:36.34Z","modified":"2026-11-03T06:33:02.957418576Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"GHSA-f74p-cwhp-x2wx","title":"Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.","description":"The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.","status":"published","published":"2026-06-22T15:30:43Z","modified":"2026-09-28T17:10:47.137426029Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"GO-2026-6544","title":"Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana","description":"Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.","status":"published","published":"2026-09-28T16:43:40Z","modified":"2026-09-28T17:00:25.303025125Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}