{"id":"CVE-2026-21726","aliases":["GHSA-497x-rrr9-68jp","GO-2026-5115"],"title":"Grafana Loki Path Traversal - CVE-2021-36156 Bypass","summary":"Grafana Loki Path Traversal - CVE-2021-36156 Bypass","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"grafana","product":"github.com/grafana/loki/v3","ecosystem":"go","affected":["github.com/grafana/loki/v3 < 3.6.4"],"patched":["github.com/grafana/loki/v3 3.6.4"],"published":"2026-04-15","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:00.938890119Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-497x-rrr9-68jp","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21726"},{"url":"https://github.com/grafana/loki"},{"url":"https://grafana.com/security/security-advisories/cve-2026-21726"},{"url":"https://github.com/advisories/GHSA-497x-rrr9-68jp"}],"tags":["osv","go"],"epss":0.00409,"epssPercentile":0.34948,"ingestedAt":"2026-07-09T18:56:37.049Z","slug":"CVE-2026-21726","body":"## Overview\n\nThe CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability.\n\n## Affected packages\n\n- `github.com/grafana/loki/v3 < 3.6.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/grafana/loki/v3 3.6.4`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201478,"id":"CVE-2026-21726","ts":1789399489236,"field":"cvss","old":null,"new":"5.3"},{"seq":201477,"id":"CVE-2026-21726","ts":1789399489236,"field":"severity","old":"none","new":"medium"},{"seq":200212,"id":"CVE-2026-21726","ts":1789397031758,"field":"cvss","old":"5.3","new":null},{"seq":200211,"id":"CVE-2026-21726","ts":1789397031758,"field":"severity","old":"medium","new":"none"},{"seq":198136,"id":"CVE-2026-21726","ts":1789391717372,"field":"cvss","old":null,"new":"5.3"},{"seq":198135,"id":"CVE-2026-21726","ts":1789391717372,"field":"severity","old":"none","new":"medium"},{"seq":195929,"id":"CVE-2026-21726","ts":1789383366569,"field":"cvss","old":"5.3","new":null},{"seq":195928,"id":"CVE-2026-21726","ts":1789383366569,"field":"severity","old":"medium","new":"none"},{"seq":194858,"id":"CVE-2026-21726","ts":1789380289584,"field":"cvss","old":null,"new":"5.3"},{"seq":194857,"id":"CVE-2026-21726","ts":1789380289584,"field":"severity","old":"none","new":"medium"},{"seq":193645,"id":"CVE-2026-21726","ts":1789378231390,"field":"cvss","old":"5.3","new":null},{"seq":193644,"id":"CVE-2026-21726","ts":1789378231390,"field":"severity","old":"medium","new":"none"},{"seq":192432,"id":"CVE-2026-21726","ts":1789376212700,"field":"cvss","old":null,"new":"5.3"},{"seq":192431,"id":"CVE-2026-21726","ts":1789376212700,"field":"severity","old":"none","new":"medium"},{"seq":191219,"id":"CVE-2026-21726","ts":1789373090859,"field":"cvss","old":"5.3","new":null},{"seq":191218,"id":"CVE-2026-21726","ts":1789373090859,"field":"severity","old":"medium","new":"none"},{"seq":190004,"id":"CVE-2026-21726","ts":1789369110789,"field":"cvss","old":null,"new":"5.3"},{"seq":190003,"id":"CVE-2026-21726","ts":1789369110789,"field":"severity","old":"none","new":"medium"},{"seq":188791,"id":"CVE-2026-21726","ts":1789368019458,"field":"cvss","old":"5.3","new":null},{"seq":188790,"id":"CVE-2026-21726","ts":1789368019458,"field":"severity","old":"medium","new":"none"},{"seq":187574,"id":"CVE-2026-21726","ts":1789364982221,"field":"cvss","old":null,"new":"5.3"},{"seq":187573,"id":"CVE-2026-21726","ts":1789364982221,"field":"severity","old":"none","new":"medium"},{"seq":186361,"id":"CVE-2026-21726","ts":1789362965753,"field":"cvss","old":"5.3","new":null},{"seq":186360,"id":"CVE-2026-21726","ts":1789362965753,"field":"severity","old":"medium","new":"none"},{"seq":185147,"id":"CVE-2026-21726","ts":1789360953690,"field":"cvss","old":null,"new":"5.3"},{"seq":185146,"id":"CVE-2026-21726","ts":1789360953690,"field":"severity","old":"none","new":"medium"},{"seq":183934,"id":"CVE-2026-21726","ts":1789357898699,"field":"cvss","old":"5.3","new":null},{"seq":183933,"id":"CVE-2026-21726","ts":1789357898699,"field":"severity","old":"medium","new":"none"},{"seq":182186,"id":"CVE-2026-21726","ts":1789354078246,"field":"cvss","old":null,"new":"5.3"},{"seq":182185,"id":"CVE-2026-21726","ts":1789354078246,"field":"severity","old":"none","new":"medium"},{"seq":180979,"id":"CVE-2026-21726","ts":1789352917698,"field":"cvss","old":"5.3","new":null},{"seq":180978,"id":"CVE-2026-21726","ts":1789352917698,"field":"severity","old":"medium","new":"none"},{"seq":179772,"id":"CVE-2026-21726","ts":1789349978410,"field":"cvss","old":null,"new":"5.3"},{"seq":179771,"id":"CVE-2026-21726","ts":1789349978410,"field":"severity","old":"none","new":"medium"},{"seq":178565,"id":"CVE-2026-21726","ts":1789347769705,"field":"cvss","old":"5.3","new":null},{"seq":178564,"id":"CVE-2026-21726","ts":1789347769705,"field":"severity","old":"medium","new":"none"},{"seq":177358,"id":"CVE-2026-21726","ts":1789346160246,"field":"cvss","old":null,"new":"5.3"},{"seq":177357,"id":"CVE-2026-21726","ts":1789346160246,"field":"severity","old":"none","new":"medium"},{"seq":176151,"id":"CVE-2026-21726","ts":1789342704601,"field":"cvss","old":"5.3","new":null},{"seq":176150,"id":"CVE-2026-21726","ts":1789342704601,"field":"severity","old":"medium","new":"none"},{"seq":175935,"id":"CVE-2026-21726","ts":1789342315972,"field":"cvss","old":null,"new":"5.3"},{"seq":175934,"id":"CVE-2026-21726","ts":1789342315972,"field":"severity","old":"none","new":"medium"},{"seq":175475,"id":"CVE-2026-21726","ts":1789338358178,"field":"cvss","old":"5.3","new":null},{"seq":175474,"id":"CVE-2026-21726","ts":1789338358178,"field":"severity","old":"medium","new":"none"},{"seq":174270,"id":"CVE-2026-21726","ts":1789334583960,"field":"cvss","old":null,"new":"5.3"},{"seq":174269,"id":"CVE-2026-21726","ts":1789334583960,"field":"severity","old":"none","new":"medium"},{"seq":173065,"id":"CVE-2026-21726","ts":1789333191481,"field":"cvss","old":"5.3","new":null},{"seq":173064,"id":"CVE-2026-21726","ts":1789333191481,"field":"severity","old":"medium","new":"none"},{"seq":171879,"id":"CVE-2026-21726","ts":1789330870676,"field":"cvss","old":null,"new":"5.3"},{"seq":171878,"id":"CVE-2026-21726","ts":1789330870676,"field":"severity","old":"none","new":"medium"}]}