CVE-2026-42129

{
  "id": "CVE-2026-42129",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-22T14:17:36.340",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information."
    },
    {
      "lang": "es",
      "value": "El gestor callResource del plugin de fuente de datos de Loki contiene una vulnerabilidad de salto de ruta. Un usuario autenticado con rol de Visor puede escapar del sandbox de recursos del plugin y acceder a puntos finales administrativos de Loki (p. ej., /config, /services, /ready) para extraer configuración sensible del backend e información de servicio interna."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana OSS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "11.6.0",
              "lessThanOrEqual": "11.6.14",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "12.2.0",
              "lessThanOrEqual": "12.2.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "12.3.0",
              "lessThanOrEqual": "12.3.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "12.4.0",
              "lessThanOrEqual": "12.4.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "13.0.0",
              "lessThanOrEqual": "13.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-22T15:44:32.401117Z",
          "id": "CVE-2026-42129",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:grafana:loki_datasource:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC9FBA76-8620-4AE4-85A3-AB43E19A6331"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2026-42129",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    }
  ]
}