What is CVE-2026-42129?

CVE-2026-42129 is a security advisory published by Grafana Labs Security. Path traversal in the Loki data source leads to internal information disclosure

Why does CVE-2026-42129 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by CVE-2026-42129?

CVE-2026-42129 affects 1 product, including: Loki.

CVE-2026-42129Disclosed before NVD

Path traversal in the Loki data source leads to internal information disclosure

Vendor

Grafana Labs Security

Published

June 9, 2026

Last Modified

—

📋 Description

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information. Upgrade to a fixed version listed below.

🎯 Affected products1

Loki

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-42129/