CVE-2026-42129

Modified Modified - Updated After Analysis

Path Traversal in Grafana Loki Datasource Plugin

Publication date: 2026-06-22

Last updated on: 2026-07-10

Assigner: Grafana Labs

Description

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-07-10

Generated

2026-07-12

AI Q&A

2026-06-23

EPSS Evaluated

2026-07-11

NVD

CVE-2026-42129

EUVD

EUVD-2026-38241

Affected Vendors & Products

Vendor	Product	Version / Range
grafana	loki_datasource	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Compliance Impact

The vulnerability allows an authenticated Viewer-role user to access sensitive backend configuration and internal service information by escaping the plugin's resource sandbox. This exposure of sensitive information could potentially lead to non-compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and system configurations.

However, specific impacts on compliance with these standards are not detailed in the provided information.

Executive Summary

The Loki datasource plugin's callResource handler has a path traversal vulnerability. This means that an authenticated user with Viewer role privileges can bypass the plugin's resource sandbox restrictions.

By exploiting this vulnerability, the user can access administrative Loki endpoints such as /config, /services, and /ready, which are normally restricted.

This unauthorized access allows the extraction of sensitive backend configuration and internal service information.

Impact Analysis

This vulnerability can have significant impacts because it allows an authenticated Viewer-role user to access sensitive backend configuration and internal service information.

Such unauthorized access could lead to exposure of critical system details that might be used for further attacks or exploitation.

The CVSS base score of 7.7 indicates a high severity, emphasizing the potential risk to confidentiality.

Hi! I’m here to help you understand CVE-2026-42129. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70