Loki
by Grafana
Source repositories
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-42129 | Hig | 0.50 | 7.7 | 0.00 | Jun 22, 2026 | A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information. | ||
| CVE-2026-21726 | Med | 0.27 | 5.3 | 0.00 | Apr 15, 2026 | The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this… | ||
| CVE-2026-21729 | Hig | 0.00 | 7.5 | 0.00 | Jul 16, 2026 | Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. | ||
| CVE-2021-36156 | Med | 0.00 | 5.3 | 0.01 | Aug 3, 2021 | An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules… |
- risk 0.50cvss 7.7epss 0.00
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
- risk 0.27cvss 5.3epss 0.00
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this…
- risk 0.00cvss 7.5epss 0.00
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
- risk 0.00cvss 5.3epss 0.01
An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules…