CVE-2026-42129: Grafana Loki Data Source Path Traversal Vulnerability

Technical summary

CVE-2026-42129 is a path traversal vulnerability (CWE-22) in the Loki data source plugin for Grafana. The vulnerability exists in how the plugin processes requests to backend Loki endpoints, failing to properly validate or sanitize file path inputs. An attacker with Viewer-level permissions—the lowest privilege tier in Grafana—can construct requests with path traversal sequences (such as '../') to escape the intended scope and access administrative endpoints. This grants unauthorized read access to backend configuration files and internal service metadata that should be isolated to administrative users. The CVSS 3.1 score of 7.7 (HIGH) reflects the combination of network accessibility, low attack complexity, and confidentiality impact; integrity and availability are not affected.

Business impact

Exposure of backend configuration and internal service architecture information creates multiple business risks. Attackers gain detailed knowledge of your Loki deployment topology, service interdependencies, and potentially hardcoded credentials or API keys in configuration data. This reconnaissance accelerates follow-on attacks and may breach compliance requirements around sensitive data protection. The threat is amplified in environments with many Grafana users—any user granted Viewer permissions becomes a potential attack vector. Organizations relying on Loki for observability and log management should assess whether configuration details leaked through this flaw could lead to lateral movement or unauthorized access to other infrastructure.

Affected systems

The vulnerability specifically affects the Loki data source plugin for Grafana. All installations using this plugin with at least one Viewer-level user are potentially vulnerable. The flaw impacts both cloud-hosted and self-managed Grafana instances. The vulnerability requires authentication (user must have valid Grafana credentials and Viewer permission or higher), limiting exposure to insider threats and accounts compromised through phishing or credential reuse. Confirm your Loki plugin version against vendor advisories to determine exact affected versions.

Exploitability

Exploitation is straightforward for a threat actor with basic Grafana access. No special network conditions, complex tooling, or user interaction are required—only the ability to authenticate and craft HTTP requests with path traversal payloads. The attack is entirely passive from a detection standpoint (read-only, no data modification), making it attractive for reconnaissance. The low barrier to entry, combined with the value of the stolen information, means this vulnerability should be considered actively exploitable in untrusted or high-privilege-user environments. Notably, this vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but absence from KEV does not indicate low risk in your environment.

Remediation

Patch to the corrected version of the Loki data source plugin as supplied by Grafana. Grafana has released security updates addressing this path traversal flaw; consult the vendor advisory for your specific plugin version to identify the patched release. Until patching is complete, restrict Viewer-level permissions to trusted users only, and consider temporarily disabling the Loki data source plugin in non-production environments if feasible. Review and audit Viewer-level access in your Grafana instance to identify over-privileged or dormant accounts that should be revoked.

Patch guidance

Apply the security update released by Grafana for the Loki data source plugin. The fix validates and sanitizes file path inputs to prevent traversal sequences from reaching administrative endpoints. Update your Grafana environment and verify the Loki plugin version post-deployment by checking the plugin configuration page or via the Grafana API. If you are running Grafana on Kubernetes, follow your orchestration platform's standard update procedures to ensure high availability during patching. Test in a staging environment first to confirm compatibility with your existing Loki backend and any custom dashboards.

Detection guidance

Monitor for suspicious HTTP requests to the Loki data source plugin endpoint that include path traversal patterns (e.g., '../', '..\\', percent-encoded variants). Log and alert on requests from authenticated users (Viewer privilege level) attempting to access administrative Loki paths. Check Grafana access logs for repeated 403 or 404 responses to non-existent or restricted administrative endpoints, which may indicate reconnaissance. If you have Loki query logs enabled, look for queries originating from users with Viewer permissions that reference configuration or backend metadata rather than observability data. Consider implementing rate-limiting on administrative endpoint access to reduce the window for data exfiltration.

Why prioritize this

This vulnerability merits prompt remediation due to its HIGH CVSS score, low attack complexity, and direct impact on confidential data. The combination of authenticated-but-low-privilege access (Viewer) and reliable exploitability makes it a priority for any Grafana deployment with multiple users. Configuration and service information breaches directly enable further attacks; patching eliminates the reconnaissance vector. The fact that it is not yet in the KEV catalog does not reduce urgency—your environment's threat model and user access patterns are the key drivers.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) is derived from: network-based attack vector (AV:N), low attack complexity requiring only authentication and basic path traversal knowledge (AC:L), low privilege requirement (PR:L for Viewer access), no user interaction needed (UI:N), scope change due to access to backend administrative functions (S:C), high confidentiality impact from exposed configuration and service data (C:H), no integrity or availability impact (I:N/A:N). This reflects a realistic threat in multi-user environments where information disclosure can directly enable privilege escalation or lateral movement.

Frequently asked questions