CVE-2026-42129 Path traversal in the Loki data source plugin
A user with Viewer permissions can exploit path traversal in the Loki plugin to access administrative endpoints and read sensitive backend configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42129?
CVE-2026-42129 is a high-severity path traversal vulnerability in Grafana OSS, published on 22 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
Weakness: CWE-22
Which versions are affected by CVE-2026-42129?
14 open source packages ship an affected version, including github.com/grafana/grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | None |
github.com/grafana/grafana Go | All versions | 1.9.2-0.20260616075434-82ef13993059 |
github.com/grafana/grafana Go | All versions | 1.9.2-0.20260616075434-82ef13993059 |
github.com/grafana/grafana Go | From 12.0.0 | None |
github.com/grafana/grafana Go | From 12.0.0 | None |
github.com/grafana/grafana Go | From 12.3.0 | None |
8 more packages
github.com/grafana/grafana Go | From 12.3.0 | None |
github.com/grafana/grafana Go | From 12.4.0 | None |
github.com/grafana/grafana Go | From 12.4.0 | None |
github.com/grafana/grafana Go | From 13.0.0 | None |
github.com/grafana/grafana Go | From 13.0.0 | None |
github.com/grafana/grafana Go | From 2.0.0-beta1 | None |
github.com/grafana/grafana Go | From 2.0.0-beta1 | None |
github.com/grafana/grafana Go | From 2.0.0-beta1+incompatible | None |
Products include Grafana Loki Datasource.
How do I fix CVE-2026-42129?
Upgrade github.com/grafana/grafana to 1.9.2-0.20260616075434-82ef13993059 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-42129 being exploited?
There is no known exploitation of CVE-2026-42129 in the wild and no public exploit code.
Sources
Also known as GHSA-f74p-cwhp-x2wx, GO-2026-6544, MINI-2285-5hvm-qmgh, MINI-2835-27mm-rg7p, MINI-35cj-mqqg-h6rq, MINI-7hpv-4f46-8crm and 13 more.