Description
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana OSS | 11.6.0 – ≤ 11.6.14, 12.2.0 – ≤ 12.2.8, 12.3.0 – ≤ 12.3.6, 12.4.0 – ≤ 12.4.3, 13.0.0 – ≤ 13.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 2.0.0-beta1 | — | GHSA-f74p-cwhp-x2wx |
| Go | github.com/grafana/grafana | >= 12.0.0 | — | GHSA-f74p-cwhp-x2wx |
| Go | github.com/grafana/grafana | >= 12.3.0 | — | GHSA-f74p-cwhp-x2wx |
| Go | github.com/grafana/grafana | >= 13.0.0 | — | GHSA-f74p-cwhp-x2wx |
| Go | github.com/grafana/grafana | >= 12.4.0 | — | GHSA-f74p-cwhp-x2wx |
| Go | github.com/grafana/grafana | < 1.9.2-0.20260616075434-82ef13993059 | 1.9.2-0.20260616075434-82ef13993059 | GHSA-f74p-cwhp-x2wx |
| Go | github.com/grafana/grafana | all versions | — | GO-2026-6544 |
| Go | github.com/grafana/grafana | >= 2.0.0-beta1+incompatible | — | GO-2026-6544 |
Advisories 1
- WID-SEC-2026-4337 Grafana: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 3, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-42129 vendor-advisory