Skip to content
OpenAdvisories

Package · Go

github.com/grafana/loki

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.3
    CVE-2026-21726

    Loki Path Traversal - CVE-2021-36156 Bypass

    The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for report…

    Grafana Loki github.com/grafana/loki github.com/grafana/loki/v3 Go
  • Medium 5.3
    CVE-2021-36156

    Path traversal in Grafana Loki

    An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt…

    github.com/grafana/loki Go