CVE-2026-21726

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2026-21726	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:grafana:loki:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La corrección de CVE-2021-36156 valida el parámetro namespace para secuencias de salto de ruta después de una única decodificación URL, mediante doble codificación, un atacante puede leer archivos en el endpoint de la API de Ruler /loki/api/v1/rules/{namespace} Gracias a Prasanth Sundararajan por informar sobre esta vulnerabilidad.

Information

Published : 2026-04-15 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-21726

Mitre link : CVE-2026-21726

CVE.ORG link : CVE-2026-21726

JSON object : View

Products Affected

grafana

loki

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-21726", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21726", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T20:01:24.769436Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@grafana.com", "affectedData": [{"vendor": "Grafana", "product": "Loki", "versions": [{"status": "affected", "version": "2.3.0", "lessThan": "3.5.9", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-15T20:16:34.177", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21726", "tags": ["Vendor Advisory"], "source": "security@grafana.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability."}, {"lang": "es", "value": "La correcci\u00f3n de CVE-2021-36156 valida el par\u00e1metro namespace para secuencias de salto de ruta despu\u00e9s de una \u00fanica decodificaci\u00f3n URL, mediante doble codificaci\u00f3n, un atacante puede leer archivos en el endpoint de la API de Ruler /loki/api/v1/rules/{namespace}\n\nGracias a Prasanth Sundararajan por informar sobre esta vulnerabilidad."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grafana:loki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A927B56-3873-4166-8F65-6E312D898B03", "versionEndExcluding": "3.6.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@grafana.com"}