{"id":"EUVD-2026-23100","enisaUuid":"387ebd2c-015c-3062-9e64-e788e797cdad","description":"The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability.","datePublished":"Apr 15, 2026, 7:24:31 PM","dateUpdated":"Aug 27, 2026, 5:22:30 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://grafana.com/security/security-advisories/cve-2026-21726\n","aliases":"CVE-2026-21726\n","assigner":"GRAFANA","epss":0.41,"enisaIdProduct":[{"id":"a88c6b67-07e8-3bcc-a191-564a64c0fd4c","product":{"name":"Loki","vendor":{"name":"Grafana"}},"product_version":"2.3.0 \u003c3.5.9"}],"enisaIdVendor":[{"id":"7801750f-5b50-3be8-9b9f-34dfb8a84822","vendor":{"name":"Grafana"}}],"enisaIdVulnerability":[{"id":"8f3d162f-1178-3d79-8521-fd4f41d2a626","vulnerability":{"id":"GHSA-497x-rrr9-68jp","description":"Grafana Loki Path Traversal - CVE-2021-36156 Bypass","datePublished":"Apr 15, 2026, 9:30:18 PM","dateUpdated":"Apr 16, 2026, 9:42:00 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-21726\nhttps://github.com/grafana/loki\nhttps://grafana.com/security/security-advisories/cve-2026-21726\n","enisa_id":"EUVD-2026-23100\n","aliases":"GHSA-497x-rrr9-68jp\nCVE-2026-21726\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c204530d-3699-36c2-b527-10c95f8be45d","vulnerability":{"id":"CVE-2026-21726","description":"The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability.","datePublished":"Apr 15, 2026, 7:24:31 PM","dateUpdated":"Aug 27, 2026, 5:22:30 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://grafana.com/security/security-advisories/cve-2026-21726\n","enisa_id":"EUVD-2026-23100\n","assigner":"GRAFANA","epss":0.41,"dataProcessed":"Oct 29, 2026, 7:18:29 AM","vulnerabilityProduct":[{"id":"e6f2ab95-52f4-30ed-b837-911905ae724b","product":{"name":"Loki","vendor":{"name":"Grafana"}},"product_version":"2.3.0 \u003c3.5.9"}],"vulnerabilityVendor":[{"id":"b3b91f72-7ead-324b-8b30-6ac881e54b8a","vendor":{"name":"Grafana"}}]}}],"enisaIdAdvisory":[{"id":"9c4b14c7-497f-31f0-9984-54aab8adb6b8","advisory":{"id":"WID-SEC-W-2026-0242","description":"Grafana Loki: Schwachstelle ermöglicht Offenlegung von Informationen","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Grafana Loki ausnutzen, um Informationen offenzulegen.","datePublished":"Jan 27, 2026, 11:00:00 PM","dateUpdated":"Jan 27, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0242.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-0242\n","aliases":"CVE-2026-21726\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"0cbdc36d-d1cd-3e06-93a7-73c9cdf1996b","product":{"name":"Grafana Loki","vendor":{"name":"open source"}}},{"id":"e27172f7-5ac4-3517-a642-0df6ef787028","product":{"name":"3.6.4","vendor":{"name":"BirdDog"}}}]}}]}