Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-42129

Path traversal in the Loki data source plugin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana OSS

Default version status: unaffected

  • 11.6.0 to ≤ 11.6.14affected
  • 12.2.0 to ≤ 12.2.8affected
  • 12.3.0 to ≤ 12.3.6affected
  • 12.4.0 to ≤ 12.4.3affected
  • 13.0.0 to ≤ 13.0.1affected

References