Answer in brief
CVE-2026-21726 records a Unknown severity vulnerability in Loki Path Traversal - CVE-2021-36156 Bypass. The current sources do not mark it as known exploited. The current feed maps Grafana/Loki (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Grafana/Loki (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Grafana/Lokigeneric | >=2.3.0 <3.5.9 | 3.5.9 |
Published upstream
Apr 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-21726 records a Unknown severity vulnerability in Loki Path Traversal - CVE-2021-36156 Bypass. The current sources do not mark it as known exploited. The current feed maps Grafana/Loki (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Grafana/Loki (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Grafana/Lokigeneric | >=2.3.0 <3.5.9 | 3.5.9 |
Published upstream
Apr 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.
Quoted source text, attributed separately from HOL analysis.