CVE-2026-42129 Overview
CVE-2026-42129 is a path traversal vulnerability [CWE-22] in the Grafana Loki datasource plugin's callResource handler. An authenticated user holding only the Viewer role can escape the plugin's resource sandbox. The attacker reaches administrative Loki endpoints such as /config, /services, and /ready. These endpoints expose backend configuration values and internal service state. The flaw enables low-privileged accounts to harvest sensitive infrastructure details that should remain restricted to operators.
Critical Impact
A Viewer-role user can extract Loki backend configuration and internal service information by traversing outside the plugin resource path, providing reconnaissance data useful for follow-on attacks against the logging stack.
Affected Products
- Grafana Loki datasource plugin (see vendor advisory for fixed versions)
- Grafana deployments using the Loki datasource for log querying
- Self-hosted and managed Grafana stacks integrating Loki
Discovery Timeline
- 2026-06-22 - CVE-2026-42129 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-42129
Vulnerability Analysis
The Loki datasource plugin exposes a callResource handler that proxies HTTP requests from the Grafana frontend to the Loki backend. The handler is intended to restrict requests to a curated set of resource paths the plugin needs to function. The implementation fails to normalize and validate the requested path before forwarding it to Loki. An attacker submits a crafted path containing traversal sequences that resolve outside the intended sandbox.
Because the request still carries the datasource's server-side credentials, Loki processes the upstream call as a trusted client. Administrative endpoints such as /config, /services, and /ready respond with operational data. Returned configuration can include storage backends, authentication settings, ring topology, and runtime parameters. The disclosure is purely a confidentiality breach. The CVSS vector indicates no integrity or availability impact, but the scope change reflects access to a system beyond the Grafana authorization boundary.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory inside the plugin's callResource routing logic. The handler concatenates or forwards user-controlled path segments without canonicalization, allowing ../ sequences or absolute path overrides to reach Loki administrative routes.
Attack Vector
Exploitation requires network access to a Grafana instance and any authenticated account, including a Viewer. The attacker issues a request to the Loki datasource resource API with a traversal payload in the path. Grafana forwards the call to Loki using its configured credentials. The response returns administrative endpoint content directly to the low-privileged user.
No exploitation code is published. See the Grafana Security Advisory CVE-2026-42129 for vendor-provided technical detail.
Detection Methods for CVE-2026-42129
Indicators of Compromise
- Grafana access logs containing datasource callResource requests with .., encoded traversal sequences such as %2e%2e, or absolute paths in the resource segment.
- Loki access logs showing requests to /config, /services, /ready, /metrics, or other administrative endpoints originating from the Grafana datasource proxy.
- Viewer-role user IDs associated with outbound datasource calls that retrieve large configuration payloads.
Detection Strategies
- Correlate Grafana audit events for datasource resource calls with Loki upstream logs to identify path mismatches between requested plugin resources and accessed Loki routes.
- Alert on any Loki administrative endpoint access where the source is the Grafana datasource service account rather than an operator workstation or CI tool.
- Baseline normal callResource paths used by the Loki plugin and flag deviations, particularly responses with unusually large body sizes.
Monitoring Recommendations
- Enable Grafana request logging at debug level for datasource proxy calls during incident review and forward logs to a central analytics platform.
- Monitor Loki for spikes in /config or /services requests and tie request identifiers back to the originating Grafana session.
- Track Viewer accounts that issue datasource resource calls outside expected dashboard workflows.
How to Mitigate CVE-2026-42129
Immediate Actions Required
- Upgrade the Grafana Loki datasource plugin to the fixed version listed in the Grafana Security Advisory CVE-2026-42129.
- Audit Grafana user accounts and remove unused Viewer access to limit the population able to invoke the vulnerable handler.
- Rotate any secrets that may have been exposed through Loki configuration if administrative endpoints were reachable in your deployment.
Patch Information
Grafana has published a security advisory documenting the affected plugin versions and patched releases. Apply the vendor-supplied update through the Grafana plugin manager or your deployment's package management process. Restart Grafana after upgrade to load the patched plugin binary.
Workarounds
- Restrict network access to the Loki backend so that only specific Grafana service endpoints can reach it, blocking administrative routes at a reverse proxy.
- Place an authenticating proxy in front of Loki that denies requests targeting /config, /services, /ready, and /metrics from the Grafana datasource identity.
- Temporarily disable the Loki datasource for tenants where upgrade cannot be performed immediately.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
