Grafana: >> Loki Datasource Security Vulnerabilities
The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.
CVSS Score
7.7
EPSS Score
0.004
Published
2026-06-22