CVE-2026-21726

{
  "id": "CVE-2026-21726",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T20:16:34.177",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability."
    },
    {
      "lang": "es",
      "value": "La corrección de CVE-2021-36156 valida el parámetro namespace para secuencias de salto de ruta después de una única decodificación URL, mediante doble codificación, un atacante puede leer archivos en el endpoint de la API de Ruler /loki/api/v1/rules/{namespace}\n\nGracias a Prasanth Sundararajan por informar sobre esta vulnerabilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Loki",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2.3.0",
              "lessThan": "3.5.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-15T20:01:24.769436Z",
          "id": "CVE-2026-21726",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:grafana:loki:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.6.4",
              "matchCriteriaId": "4A927B56-3873-4166-8F65-6E312D898B03"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2026-21726",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}