CVE-2026-42129
Fixed upstream EPSS <1%CVSS 7.7
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
Products: Grafana OSS
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | no fix |
| Go | github.com/grafana/grafana | 1.9.2-0.20260616075434-82ef13993059 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |