{"id":"EUVD-2026-38241","enisaUuid":"0b27a669-6362-3d67-a12b-eadc6ca67106","description":"A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.","datePublished":"Jun 22, 2026, 1:18:27 PM","dateUpdated":"Aug 27, 2026, 5:22:32 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://grafana.com/security/security-advisories/cve-2026-42129\n","aliases":"CVE-2026-42129\nGHSA-f74p-cwhp-x2wx\n","assigner":"GRAFANA","epss":0.44,"enisaIdProduct":[{"id":"6f62923e-e7b0-38e4-a752-c67a7af584f9","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.2.0 ≤12.2.8"},{"id":"c8f39d92-4c96-3c8a-b6aa-afaae4e030ef","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"11.6.0 ≤11.6.14"},{"id":"d4b0c9f0-0780-3704-a7ca-f37c7fd2d525","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"13.0.0 ≤13.0.1"},{"id":"e29998cb-2f23-31eb-9c57-f776c478dbef","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.3.0 ≤12.3.6"},{"id":"fc5bfa34-12c4-34a2-8c64-6a2e23d784bd","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.4.0 ≤12.4.3"}],"enisaIdVendor":[{"id":"66f59946-b5a5-3f1c-9c9e-5d19a953a685","vendor":{"name":"Grafana"}}],"enisaIdVulnerability":[{"id":"5531a541-ec9e-31e3-b409-29ddb33546f7","vulnerability":{"id":"GHSA-f74p-cwhp-x2wx","description":"Grafana Loki datasource plugin\u0027s callResource handler contains a path traversal vulnerability.","datePublished":"Jun 22, 2026, 3:30:43 PM","dateUpdated":"Sep 21, 2026, 10:54:43 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-42129\nhttps://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1\nhttps://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29\nhttps://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4\nhttps://github.com/grafana/grafana/commit/d27d2eba9c509d16f214d290436a6ad0bd9c6c01\nhttps://github.com/grafana/grafana/commit/dd5dc51681ff0133ddb2e206c2ea318713aeca16\nhttps://github.com/grafana/grafana/commit/eeb08ceb020c4381242d8400e5878044e9877505\nhttps://github.com/grafana/grafana/commit/f70d3e480274a5dbd12006338c393f4b05d441ca\nhttps://github.com/grafana/grafana\nhttps://github.com/grafana/grafana/releases/tag/v11.6.15\nhttps://github.com/grafana/grafana/releases/tag/v12.2.9\nhttps://github.com/grafana/grafana/releases/tag/v12.3.7\nhttps://github.com/grafana/grafana/releases/tag/v12.4.4\nhttps://github.com/grafana/grafana/releases/tag/v13.0.2\nhttps://grafana.com/security/security-advisories/cve-2026-42129\n","enisa_id":"EUVD-2026-38241\n","aliases":"CVE-2026-42129\nGHSA-f74p-cwhp-x2wx\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c5f128dc-cc0c-39f5-9d10-ced431b6dbe6","vulnerability":{"id":"CVE-2026-42129","description":"A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.","datePublished":"Jun 22, 2026, 1:18:27 PM","dateUpdated":"Aug 27, 2026, 5:22:32 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://grafana.com/security/security-advisories/cve-2026-42129\n","enisa_id":"EUVD-2026-38241\n","assigner":"GRAFANA","epss":0.44,"dataProcessed":"Nov 5, 2026, 7:17:24 AM","vulnerabilityProduct":[{"id":"0085b89e-3082-36d4-b5b1-12ab6eb4d579","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.4.0 ≤12.4.3"},{"id":"2f8ee302-5f65-3a36-b396-0acba7724d13","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.2.0 ≤12.2.8"},{"id":"61cdd3b7-47f4-357e-9929-ac8956bd4c89","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"12.3.0 ≤12.3.6"},{"id":"823fb90d-59c9-3f69-a70c-21b48ab93af5","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"13.0.0 ≤13.0.1"},{"id":"8a4e41c5-cd2b-385e-b42a-e4fb743e0c1b","product":{"name":"Grafana OSS","vendor":{"name":"Grafana"}},"product_version":"11.6.0 ≤11.6.14"}],"vulnerabilityVendor":[{"id":"39e35508-9332-3422-a506-3f2d3ce19ed5","vendor":{"name":"Grafana"}}]}}],"enisaIdAdvisory":[]}