CVE-2026-42129: Path traversal in the Loki data source plugin
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/grafanato a version that resolves this vulnerability.Fixed in 12.4.4-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42129?
CVE-2026-42129 has a severity rating of high, with a score of 7.7.
How do I fix CVE-2026-42129?
To fix CVE-2026-42129, update the Grafana Loki datasource plugin to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-42129?
CVE-2026-42129 is a path traversal vulnerability that can lead to internal information disclosure.
Who is affected by CVE-2026-42129?
Authenticated Viewer-role users of the Grafana Loki datasource plugin are affected by CVE-2026-42129.
What can attackers achieve with CVE-2026-42129?
Attackers can exploit CVE-2026-42129 to escape the resource sandbox and access sensitive administrative Loki endpoints.