CVE-2026-42129

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2026-42129	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:grafana:loki_datasource:-:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El gestor callResource del plugin de fuente de datos de Loki contiene una vulnerabilidad de salto de ruta. Un usuario autenticado con rol de Visor puede escapar del sandbox de recursos del plugin y acceder a puntos finales administrativos de Loki (p. ej., /config, /services, /ready) para extraer configuración sensible del backend e información de servicio interna.

Information

Published : 2026-06-22 14:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-42129

Mitre link : CVE-2026-42129

CVE.ORG link : CVE-2026-42129

JSON object : View

Products Affected

grafana

loki_datasource

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-42129", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42129", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T15:44:32.401117Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security@grafana.com", "affectedData": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"status": "affected", "version": "12.2.0", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T14:17:36.340", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-42129", "tags": ["Broken Link"], "source": "security@grafana.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@grafana.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information."}, {"lang": "es", "value": "El gestor callResource del plugin de fuente de datos de Loki contiene una vulnerabilidad de salto de ruta. Un usuario autenticado con rol de Visor puede escapar del sandbox de recursos del plugin y acceder a puntos finales administrativos de Loki (p. ej., /config, /services, /ready) para extraer configuraci\u00f3n sensible del backend e informaci\u00f3n de servicio interna."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grafana:loki_datasource:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC9FBA76-8620-4AE4-85A3-AB43E19A6331"}], "operator": "OR"}]}], "sourceIdentifier": "security@grafana.com"}