A double URL‑encoding bypass allows an attacker to trick the Loki namespace validator into performing a single decode that still contains a path traversal sequence. The attacker can then read files through the /loki/api/v1/rules/{namespace} endpoint. The impact is that sensitive files on the host can be exfiltrated, potentially exposing configuration or credential data. The weakness corresponds to improper input validation (CWE-22).

Grafana Loki deployments that have not yet applied the fix for CVE-2021-36156. The vulnerability is specifically tied to the Ruler API endpoint and applies to any version of Loki before the patched release; no exact version range was supplied in the advisory.

The CVSS score of 5.3 indicates medium severity, and the EPSS score is not listed, so public exploitation data is unavailable. The vulnerability is not currently in the CISA KEV catalog. Attack vectors are inferred to be network‑based; an entity with network access to the Ruler API could craft the payload. Exploitation requires only that the attacker can supply a crafted namespace parameter via an HTTP request to the Loki instance.