CVE-2026-21726
Fixed in a distro release EPSS <1%CVSS 5.3
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.
Products: Grafana Loki
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/loki | no fix |
| Go | github.com/grafana/loki/v3 | 3.6.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-grafana-11.6 | 11.6.16-r0 |
| Chainguard | commercial-grafana-12.1 | no fix |
| Chainguard | commercial-grafana-12.2 | 12.2.10-r0 |
| Chainguard | commercial-grafana-12.3 | 12.3.8-r0 |
| Chainguard | commercial-grafana-12.4 | 12.4.5-r0 |
| Chainguard | grafana-11.5 | no fix |
| Chainguard | grafana-11.6 | 11.6.15-r0 |
| Chainguard | grafana-12.0 | no fix |
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-12.2 | 12.2.9-r0 |
| Chainguard | grafana-12.3 | 12.3.7-r0 |
| Chainguard | grafana-12.4 | 12.4.4-r0 |
| Chainguard | grafana-13.0 | 13.0.2-r0 |
| Chainguard | grafana-alloy | 1.15.1-r2 |
| Chainguard | grafana-alloy-fips | 1.15.1-r1 |
| Chainguard | grafana-fips-11.5 | no fix |
| Chainguard | grafana-fips-11.6 | 11.6.15-r0 |
| Chainguard | grafana-fips-12.0 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | 12.2.9-r0 |
| Chainguard | grafana-fips-12.3 | 12.3.7-r0 |
| Chainguard | grafana-fips-12.4 | 12.4.4-r0 |
| Chainguard | grafana-fips-13.0 | 13.0.2-r0 |
| Chainguard | loki-3.4 | no fix |
| Chainguard | loki-3.4-logcli | no fix |
| Chainguard | loki-3.4-loki-canary | no fix |
| Chainguard | loki-3.4-promtail | no fix |
| Chainguard | loki-3.5 | no fix |
| Chainguard | loki-3.5-logcli | no fix |
| Chainguard | loki-3.5-loki-canary | no fix |
| Chainguard | loki-3.5-promtail | no fix |
| Chainguard | loki-fips-3.4 | no fix |
| Chainguard | loki-fips-3.4-logcli | no fix |
| Chainguard | loki-fips-3.4-loki-canary | no fix |
| Chainguard | loki-fips-3.4-promtail | no fix |
| Chainguard | loki-fips-3.5 | no fix |
| Chainguard | loki-fips-3.5-logcli | no fix |
| Chainguard | loki-fips-3.5-loki-canary | no fix |
| Chainguard | loki-fips-3.5-promtail | no fix |
| Wolfi | grafana-12.3 | 12.3.7-r0 |
| Wolfi | grafana-12.4 | 12.4.4-r0 |
| Wolfi | grafana-13.0 | 13.0.2-r0 |
| Wolfi | grafana-alloy | 1.15.1-r2 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |