A double URL‑encoding bypass allows an attacker to trick the Loki namespace validator into performing a single decode that still contains a path traversal sequence. The attacker can then read files through the /loki/api/v1/rules/{namespace} endpoint. The impact is that sensitive files on the host can be exfiltrated, potentially exposing configuration or credential data. The weakness corresponds to improper path traversal handling (CWE-22, CWE-76).

Grafana Loki deployments that have not yet applied the fix for CVE-2021-36156. The vulnerability is specifically tied to the Ruler API endpoint and applies to any version of Loki before the patched release; no exact version range was supplied in the advisory.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of < 1% indicates an extremely low exploitation probability. The vulnerability is not currently in the CISA KEV catalog. Attack vectors are inferred to be network‑based; an entity with network access to the Ruler API could craft the payload. Exploitation requires only that the attacker can supply a crafted namespace parameter via an HTTP request to the Loki instance.