~ / search / GHSA-f74p-cwhp-x2wx

GHSA-f74p-cwhp-x2wx

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

Source: GitHub Advisory Database (reviewed) High CVE-2026-42129

Packages

EcosystemPackageAffectedFixed in
Go github.com/grafana/grafana < 11.6.15 no fix listed
Go github.com/grafana/grafana < 12.2.9 no fix listed
Go github.com/grafana/grafana < 12.3.7 no fix listed
Go github.com/grafana/grafana < 13.0.2 no fix listed
Go github.com/grafana/grafana < 12.4.4 no fix listed
Go github.com/grafana/grafana < 1.9.2-0.20260616075434-82ef13993059 1.9.2-0.20260616075434-82ef13993059

Details

As written in the advisory (Markdown source, shown as plain text).

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.

References

External links from the advisory. They lead to third-party sites.