CVE-2026-21726: Grafana Loki

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

Affected products

• Grafana Loki: before 3.6.4 (fixed in 3.6.4)

Published 2026-04-15. Last modified 2026-06-17.