CVE-2026-21726: Grafana Loki Path Traversal Vulnerability Bypass
Summary
CVE-2026-21726: Grafana Loki Path Traversal - CVE-2021-36156 Bypass. Affects github.com/grafana/loki/v3 versions < 3.6.4. Fixed in 3.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana Loki is an open-source log aggregation system designed for efficiency and scalability. It allows users to collect, store, and query logs from various sources, making it a vital tool for monitoring and troubleshooting applications. The system is built on a microservices architecture and is often used in conjunction with Grafana for visualization. However, a recent vulnerability has been identified that could allow unauthorized access to sensitive files through a path traversal attack.
Vulnerability Detail
The vulnerability arises from an improper validation of the namespace parameter in the Ruler API endpoint (/loki/api/v1/rules/{namespace}). The fix for CVE-2021-36156 only validates the parameter after a single URL decode. By exploiting this flaw through double encoding, an attacker can bypass the validation and potentially read sensitive files on the server. This could lead to unauthorized access to configuration files or other critical data, posing a significant security risk.
How To Fix
Latest published version: v3.7.9 as of 23 Oct 2026
go get github.com/grafana/loki/v3@v3.7.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.4
This is the first release that contains the fix.
go get github.com/grafana/loki/v3@v3.6.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application does not expose the Ruler API endpoint to untrusted users. Implement strict access controls to limit who can interact with this endpoint until the package can be updated.
Conclusion
The CVE-2026-21726 vulnerability in Grafana Loki poses a moderate security risk due to its potential for path traversal attacks. Users are advised to update to version 3.6.4 or later to mitigate this risk. Additionally, implementing access controls can help protect against exploitation until the update is applied.
See every vulnerability recorded for github.com/grafana/loki/v3 →
FAQ
CVE-2026-21726 is a vulnerability in Grafana Loki that allows for path traversal attacks, potentially enabling unauthorized file access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to access sensitive files on the server, leading to data breaches or unauthorized access to critical information.
Yes, the vulnerability has been patched in version 3.6.4 of Grafana Loki. It is crucial to update to this version or later.
Vulert is a monitoring tool that uses Gopkg.lock to track open-source vulnerabilities in real-time, providing alerts for any issues detected in your software.
