Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-21729

Loki detected_fields query limits results in unbounded memory allocation

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Loki
CVE-2026-42129

Path traversal in the Loki data source plugin

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Loki Datasource
CVE-2026-21726

Loki Path Traversal - CVE-2021-36156 Bypass

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Loki
CVE-2021-36156

loki: Path traversal in Grafana Loki

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Grafana
Products
Loki