GitHub Advisoryadvisory · Go

GHSA-f74p-cwhp-x2wx Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

HIGH Published 2026-06-22 Modified 2026-09-21 Official page ↗
Aliases
CVE-2026-42129
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2026-09-21

Affected packages

• Go github.com/grafana/grafana: < 11.6.15 (no fix yet) • Go github.com/grafana/grafana: < 12.2.9 (no fix yet) • Go github.com/grafana/grafana: < 12.3.7 (no fix yet) • Go github.com/grafana/grafana: < 13.0.2 (no fix yet) • Go github.com/grafana/grafana: < 12.4.4 (no fix yet) • Go github.com/grafana/grafana: < 1.9.2-0.20260616075434-82ef13993059 → fixed in 1.9.2-0.20260616075434-82ef13993059

Description

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.

Related

Alias · CVE (1)

  • CVE-2026-42129 A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References