Aller au contenu
Se connecter
5.3 Moyenne

CVE-2026-21726 The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by…

Description

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

Produits et versions touchés

Produit Versions touchées Corrigé en
Loki 2.3 2.3.0 → < 3.5.9 3.5.9

Autres CVE de Loki

Les 2 CVE de Loki →
CVE-2026-21729 Loki queries with large limits can cause large memory allocations which can impact the availability of the service,… 7.5 Élevée
Suivre cette CVE