Vulnerability Details CVE-2026-42129
The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 31.2%
CVSS Severity
CVSS v3 Score 7.7
Products affected by CVE-2026-42129
-
cpe:2.3:a:grafana:loki_datasource:-