HighFix available

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

Type: advisorySource: OSV1 source record

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.

Announced 22 Jun 2026Group revision 1

Original source ↗

GHSA-f74p-cwhp-x2wx

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-f74p-cwhp-x2wx

github.com/grafana/grafana

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/grafana/grafana

Source reference: /affected/1/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/grafana/grafana

Source reference: /affected/2/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/grafana/grafana

Source reference: /affected/3/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/grafana/grafana

Source reference: /affected/4/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/grafana/grafana

Source reference: /affected/5/package/name

Affected versions: Not stated in this record
Fixed versions: 1.9.2-0.20260616075434-82ef13993059
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "2.0.0-beta1"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/grafana/grafana",
      "purl": "pkg:golang/github.com/grafana/grafana",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f74p-cwhp-x2wx/GHSA-f74p-cwhp-x2wx.json",
      "last_known_affected_version_range": "< 11.6.15"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "12.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/grafana/grafana",
      "purl": "pkg:golang/github.com/grafana/grafana",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f74p-cwhp-x2wx/GHSA-f74p-cwhp-x2wx.json",
      "last_known_affected_version_range": "< 12.2.9"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "12.3.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/grafana/grafana",
      "purl": "pkg:golang/github.com/grafana/grafana",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f74p-cwhp-x2wx/GHSA-f74p-cwhp-x2wx.json",
      "last_known_affected_version_range": "< 12.3.7"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "13.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/grafana/grafana",
      "purl": "pkg:golang/github.com/grafana/grafana",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f74p-cwhp-x2wx/GHSA-f74p-cwhp-x2wx.json",
      "last_known_affected_version_range": "< 13.0.2"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "12.4.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/grafana/grafana",
      "purl": "pkg:golang/github.com/grafana/grafana",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f74p-cwhp-x2wx/GHSA-f74p-cwhp-x2wx.json",
      "last_known_affected_version_range": "< 12.4.4"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.9.2-0.20260616075434-82ef13993059"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/grafana/grafana",
      "purl": "pkg:golang/github.com/grafana/grafana",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f74p-cwhp-x2wx/GHSA-f74p-cwhp-x2wx.json"
    }
  }
]

Related CVEs: CVE-2026-42129
Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Event: #23393 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:18:07 GMT
Publisher date: Mon, 22 Jun 2026 15:30:43 GMT

Read the original announcement

Revision history

25 Oct 2026GHSA-f74p-cwhp-x2wx · Revision 1Source updated