PT-2026-21013 · Grafana · Loki

Published 2026-01-26 · Updated 2026-05-18 · CVE-2026-21726

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Loki (affected versions not specified)

Description An issue in the log aggregation and storage system exists due to improper restriction of the directory path name. By using double encoding to bypass validation of the namespace parameter for path traversal sequences after a single URL decode, a remote attacker can gain unauthorized access to protected information via the Ruler API endpoint '/loki/api/v1/rules/{namespace}'.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Path traversal

Weakness Enumeration

CWE-601

CWE-22

Related Identifiers

BDU:2026-02012

CLEANSTART-2026-ET12387

CLEANSTART-2026-GN78570

CLEANSTART-2026-JG72006

CLEANSTART-2026-NR54556

CLEANSTART-2026-QV77143

CLEANSTART-2026-VT65447

CVE-2026-21726

GHSA-497X-RRR9-68JP

Affected Products

Loki

References · 82

• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34165 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://grafana.com/security/security-advisories/cve-2026-21726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26958 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-NR54556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39882 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34986 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41602 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33762 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-GN78570 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41506 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33810 · Security Note