CVE-2026-21726

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}

Thanks to Prasanth Sundararajan for reporting this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Grafana	Loki	>= 2.3.0, < 3.5.9

References

https://grafana.com/security/security-advisories/cve-2026-21726Vendor Advisory

Timeline

Published: Apr 15, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-217273.3A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward c CVE-2026-217287.5Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deploy CVE-2026-217297.5Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deploym CVE-2026-21739.8A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the f CVE-2026-217306.1Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login logging mechanism. When an unauthenticated remote at CVE-2026-217329.6A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash i CVE-2026-217337.3Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user CVE-2026-217347.7A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash i CVE-2026-217364.4Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user CVE-2026-21749.8A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpo CVE-2026-217414.8An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, For CVE-2026-217426.5A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through