Namespace Parameter Vulnerability in Ruler API by Grafana

CVE-2026-21726

What is CVE-2026-21726?

The Ruler API in Grafana is susceptible to a namespace parameter vulnerability that can be exploited through path traversal sequences. By utilizing double encoding techniques, an attacker could manipulate requests to gain unauthorized access to sensitive files at the endpoint /loki/api/v1/rules/{namespace}. It is crucial for users to be aware of this issue and ensure they have the latest security updates to mitigate potential risks.

References