CVE-2026-21726 — Loki Path Traversal - CVE-2021-36156 Bypass

CVE-2026-21726

Loki Path Traversal - CVE-2021-36156 Bypass PUBLISHED

Description (CNA)

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

Affected (CNA)

Vendor / product	Versions
Grafana / Loki	affected 2.3.0 before 3.5.9

CWE

No CWE identifiers supplied.

References

https://grafana.com/security/security-advisories/cve-2026-21726

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.