CVE-2026-21726: Loki Path Traversal - CVE-2021-36156 Bypass
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}
Thanks to Prasanth Sundararajan for reporting this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/grafana/loki/v3to a version that resolves this vulnerability.Fixed in 3.6.4 - Upgrade
Upgrade
Grafana Lokito a version that resolves this vulnerability.Patch CVE-2021-36156
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21726?
CVE-2026-21726 has a high severity due to its ability to allow unauthorized file access through path traversal.
How do I fix CVE-2026-21726?
To fix CVE-2026-21726, ensure you upgrade to the latest version of Grafana Loki that addresses this vulnerability.
What are the potential impacts of CVE-2026-21726?
The potential impacts of CVE-2026-21726 include unauthorized access to sensitive files on the server.
Which versions of Grafana Loki are affected by CVE-2026-21726?
CVE-2026-21726 affects all versions of Grafana Loki prior to the patch deployment that addresses this vulnerability.
What is a path traversal vulnerability like CVE-2026-21726?
A path traversal vulnerability like CVE-2026-21726 allows attackers to manipulate file paths to gain unauthorized access to files outside of intended directories.