CVE-2026-42129
published 2026-06-22CVE-2026-42129: A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend…
PriorityP344high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.44%
37.0th percentile
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | grafana_grafana | >= 0 < 1.9.2-0.20260616075434-82ef13993059 | 1.9.2-0.20260616075434-82ef13993059 |
| github.com | grafana_grafana | >= 12.0.0 | — |
| github.com | grafana_grafana | >= 12.3.0 | — |
| github.com | grafana_grafana | >= 12.4.0 | — |
| github.com | grafana_grafana | >= 13.0.0 | — |
| github.com | grafana_grafana | >= 2.0.0-beta1 | — |
| grafana | grafana_oss | 11.6.0 – 11.6.14 | — |
| grafana | grafana_oss | 12.2.0 – 12.2.8 | — |
| grafana | grafana_oss | 12.3.0 – 12.3.6 | — |
| grafana | grafana_oss | 12.4.0 – 12.4.3 | — |
| grafana | grafana_oss | 13.0.0 – 13.0.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.
ghsa·2026-06-22
CVE-2026-42129 [HIGH] CWE-22 Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.
Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.
The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.
GHSA
The Loki datasource plugin's callResource handler contains a path traversal vulnerability.
ghsa_unreviewed·2026-06-22
CVE-2026-42129 [HIGH] The Loki datasource plugin's callResource handler contains a path traversal vulnerability.
The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-22
Published