CVE-2026-42129

Path traversal in the Loki data source plugin

Published Jun 22, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Description

Analysis

Technical impact

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information. This results in internal information disclosure that can expose system architecture and sensitive backend settings.

Affected Systems

The vulnerability affects Grafana OSS installations that use the Loki datasource plugin. The affected versions are not documented in the advisory; therefore, any Grafana OSS deployment that includes the plugin is potentially exposed until an official fix is applied.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity medium‑to‑high impact risk. The EPSS score of < 1% indicates that exploitation is very unlikely but not impossible, and the vulnerability is not recorded in CISA’s KEV catalog. Exploitation requires only valid Viewer‑role credentials, meaning any authenticated Grafana user who has Viewer permissions could trigger the exploit. An attacker can then view internal Loki configuration data and other service metadata, potentially aiding further attacks or revealing sensitive system architecture.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Grafana

Grafana OSS

unaffected

Version	Status	Constraints
`11.6.0`	affected	≤ 11.6.14
`12.2.0`	affected	≤ 12.2.8
`12.3.0`	affected	≤ 12.3.6
`12.4.0`	affected	≤ 12.4.3
`13.0.0`	affected	≤ 13.0.1

Configuration 1 [-]

cpe:2.3:a:grafana:loki_datasource:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Grafana

Version	Status	Scheme	Platform
`—`	unaffected	—	['onprem']

Grafana

Loki Datasource

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Grafana OSS to a version that includes the Loki plugin fix or apply the specific patch released by Grafana.
Restrict or remove Viewer‑role permissions for users who do not need access to internal data, or convert them to a lower‑privileged role if available.
Configure Loki to disable or restrict administrative endpoints or place them behind additional authentication and authorization controls.

Generated by OpenCVE AI on August 2, 2026 at 01:39 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-f74p-cwhp-x2wx	Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.443% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://grafana.com/security/security-advisories/cve-2026-42129

History

Jul 10, 2026 3:45 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.	A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
Title	Path Traversal in Loki Datasource leads to Internal Information Disclosure	Path traversal in the Loki data source plugin

Jun 24, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Grafana Grafana grafana Grafana loki Datasource
Vendors & Products		Grafana Grafana grafana Grafana loki Datasource

Jun 22, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 3:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-22

Jun 22, 2026 1:45 PM Description updated. Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.
Title		Path Traversal in Loki Datasource leads to Internal Information Disclosure
References		https://grafana.com/security/security-advisories/cve-2026-42129
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}`