Grafana Loki vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Grafana Loki: 2 record(s), with affected versions and fixes.cpe:2.3:a:grafana:loki
CVE-2026-21729
High · 7.5
CWE-770 Jul 16, 2026
Loki detected_fields query limits results in unbounded memory allocation
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
CVE-2026-21726
Medium · 5.3
CWE-22 Apr 15, 2026
Loki Path Traversal - CVE-2021-36156 Bypass
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}
Thanks to Prasanth Sundararajan for reporting this vulnerability.