Path traversal in the Loki data source plugin
Priority LOW 34CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Fixed github.com/grafana/grafana (Go): 1.9.2-0.20260616075434-82ef13993059
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grafana | Grafana OSS | 11.6.0 – 11.6.14; 12.2.0 – 12.2.8; 12.3.0 – 12.3.6; 12.4.0 – 12.4.3; 13.0.0 – 13.0.1 | — | No fix listed | CNA |
| — | github.com/grafana/grafana (Go) | 2.0.0-beta1 and later | — | No fix listed | GHSA-f74p-cwhp-x2wx |
| — | github.com/grafana/grafana (Go) | 12.0.0 and later | — | No fix listed | GHSA-f74p-cwhp-x2wx |
| — | github.com/grafana/grafana (Go) | 12.3.0 and later | — | No fix listed | GHSA-f74p-cwhp-x2wx |
| — | github.com/grafana/grafana (Go) | 13.0.0 and later | — | No fix listed | GHSA-f74p-cwhp-x2wx |
| — | github.com/grafana/grafana (Go) | 12.4.0 and later | — | No fix listed | GHSA-f74p-cwhp-x2wx |
| — | github.com/grafana/grafana (Go) | before 1.9.2-0.20260616075434-82ef13993059 | 1.9.2-0.20260616075434-82ef13993059 | Patch available | GHSA-f74p-cwhp-x2wx |
- Grafana OSS VendorGrafana Affected 11.6.0 – 11.6.14; 12.2.0 – 12.2.8; 12.3.0 – 12.3.6; 12.4.0 – 12.4.3; 13.0.0 – 13.0.1 Fixed in — No fix listed CNA
- github.com/grafana/grafana (Go) Vendor— Affected 2.0.0-beta1 and later Fixed in — No fix listed GHSA-f74p-cwhp-x2wx
- github.com/grafana/grafana (Go) Vendor— Affected 12.0.0 and later Fixed in — No fix listed GHSA-f74p-cwhp-x2wx
- github.com/grafana/grafana (Go) Vendor— Affected 12.3.0 and later Fixed in — No fix listed GHSA-f74p-cwhp-x2wx
- github.com/grafana/grafana (Go) Vendor— Affected 13.0.0 and later Fixed in — No fix listed GHSA-f74p-cwhp-x2wx
- github.com/grafana/grafana (Go) Vendor— Affected 12.4.0 and later Fixed in — No fix listed GHSA-f74p-cwhp-x2wx
- github.com/grafana/grafana (Go) Vendor— Affected before 1.9.2-0.20260616075434-82ef13993059 Fixed in 1.9.2-0.20260616075434-82ef13993059 Patch available GHSA-f74p-cwhp-x2wx
Remediation
- Fix · GHSA-f74p-cwhp-x2wx github.com/grafana/grafana (Go) Fixed in 1.9.2-0.20260616075434-82ef13993059 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42129
- 2026-10-03 Alias added: GHSA-f74p-cwhp-x2wx
References
Advisory 2
Other 13
- https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1
- https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29
- https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4
- https://github.com/grafana/grafana/commit/d27d2eba9c509d16f214d290436a6ad0bd9c6c01
- https://github.com/grafana/grafana/commit/dd5dc51681ff0133ddb2e206c2ea318713aeca16
- https://github.com/grafana/grafana/commit/eeb08ceb020c4381242d8400e5878044e9877505
- https://github.com/grafana/grafana/commit/f70d3e480274a5dbd12006338c393f4b05d441ca
- https://github.com/grafana/grafana
- https://github.com/grafana/grafana/releases/tag/v11.6.15
- https://github.com/grafana/grafana/releases/tag/v12.2.9
- https://github.com/grafana/grafana/releases/tag/v12.3.7
- https://github.com/grafana/grafana/releases/tag/v12.4.4
- https://github.com/grafana/grafana/releases/tag/v13.0.2
Sources
- CVE-2026-42129 · CVE Program
- CVE-2026-42129 · NVD
- FIRST EPSS
- GHSA-f74p-cwhp-x2wx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences