Skip to content
Sign in
5.3 Medium

CVE-2026-21726 The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by…

Description

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

Affected products and versions

Product Affected versions Fixed in
Loki 2.3 2.3.0 → < 3.5.9 3.5.9

Other CVEs of Loki

The 2 CVEs of Loki →
CVE-2026-21729 Loki queries with large limits can cause large memory allocations which can impact the availability of the service,… 7.5 High
Track this CVE