CLEANSTART-2026-QH06524: CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/ru...
Security vulnerability affects the grafana-alloy package. The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/grafana-alloyto a version that resolves this vulnerability.Fixed in 1.21.3-r2
Event History
Frequently Asked Questions
What endpoint is affected by this issue?
The affected endpoint is the Ruler API path /loki/api/v1/rules/{namespace}. The issue involves the namespace parameter.
What does an attacker need to do to exploit it?
An attacker must supply a namespace value containing path traversal sequences that are double URL-encoded. Validation occurs after only a single URL decode, allowing the traversal sequences to bypass that validation.
What is the impact of successful exploitation?
A successful attacker can read files through the affected Ruler API endpoint.