Vulnerability-Lookup

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-07-30 09:31

Summary

Security fixes in grafana-alloy-fips 1.15.0-r2

Details

Package grafana-alloy-fips version 1.15.0-r2 fixes 3 vulnerabilities: ghsa-497x-rrr9-68jp, ghsa-3xc5-wrhm-f963, CVE-2026-21726

References

URL

Type

https://github.com/grafana/alloy

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpine",
        "name": "grafana-alloy-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.0-r2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.15.0-r2"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package grafana-alloy-fips version 1.15.0-r2 fixes 3 vulnerabilities: ghsa-497x-rrr9-68jp, ghsa-3xc5-wrhm-f963, CVE-2026-21726",
  "id": "CLEANSTART-2026-AI90385",
  "modified": "2026-07-30T09:31:11Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/grafana/alloy"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in grafana-alloy-fips 1.15.0-r2",
  "upstream": [
    "ghsa-497x-rrr9-68jp",
    "ghsa-3xc5-wrhm-f963",
    "CVE-2026-21726"
  ]
}

CVE-2026-21726 (GCVE-0-2026-21726)

Vulnerability from cvelistv5 – Published: 2026-04-15 19:24 – Updated: 2026-07-29 14:00

Title

Loki Path Traversal - CVE-2021-36156 Bypass

Summary

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Loki	Affected: 2.3.0 , < 3.5.9 (semver)

Date Public

2026-04-15 19:20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-15T20:01:24.769436Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-20T18:58:17.749Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Loki",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "3.5.9",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-04-15T19:20:00.780Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T14:00:06.942Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-21726"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Loki Path Traversal - CVE-2021-36156 Bypass",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-21726",
    "datePublished": "2026-04-15T19:24:31.268Z",
    "dateReserved": "2026-01-05T09:26:06.215Z",
    "dateUpdated": "2026-07-29T14:00:06.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-3XC5-WRHM-F963

Vulnerability from github – Published: 2026-04-17 22:31 – Updated: 2026-05-12 13:32

Summary

go-git: Credential leak via cross-host redirect in smart HTTP transport

Details

Impact

go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations.

If a remote repository responds to the initial /info/refs request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host.

An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential.

Clients using go-git exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue. The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data.

Patches

Users should upgrade to v5.18.0, or v6.0.0-alpha.2, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

The patched versions add support for configuring followRedirects. In line with upstream behaviour, the default is now initial, while users can opt into FollowRedirects or NoFollowRedirects programmatically.

Credit

Thanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the go-git project. :bow:

Severity

4.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.17.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/go-git/go-git/v5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.18.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.0-alpha.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/go-git/go-git/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0-alpha.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41506"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-17T22:31:35Z",
    "nvd_published_at": "2026-05-08T14:16:33Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n`go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations.\n\nIf a remote repository responds to the initial `/info/refs` request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host.\n\nAn attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim\u2019s repositories or other resources, depending on the scope of the credential.\n\n**Clients using `go-git` exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue.** The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data.\n\n### Patches\nUsers should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version.\n\nThe patched versions add support for configuring [followRedirects](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpfollowRedirects). In line with upstream behaviour, the default is now `initial`, while users can opt into `FollowRedirects` or `NoFollowRedirects` programmatically.\n\n### Credit\nThanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the `go-git` project. :bow:",
  "id": "GHSA-3xc5-wrhm-f963",
  "modified": "2026-05-12T13:32:21Z",
  "published": "2026-04-17T22:31:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41506"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-git/go-git"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-git/go-git/releases/tag/v5.18.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "go-git: Credential leak via cross-host redirect in smart HTTP transport"
}

GHSA-497X-RRR9-68JP

Vulnerability from github – Published: 2026-04-15 21:30 – Updated: 2026-04-16 21:42

Summary

Grafana Loki Path Traversal - CVE-2021-36156 Bypass

Details

Thanks to Prasanth Sundararajan for reporting this vulnerability.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/grafana/loki/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21726"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T21:42:00Z",
    "nvd_published_at": "2026-04-15T20:16:34Z",
    "severity": "MODERATE"
  },
  "details": "The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability.",
  "id": "GHSA-497x-rrr9-68jp",
  "modified": "2026-04-16T21:42:00Z",
  "published": "2026-04-15T21:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21726"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grafana/loki"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2026-21726"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grafana Loki Path Traversal - CVE-2021-36156 Bypass"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from cleanstart

CVE-2026-21726 (GCVE-0-2026-21726)

GHSA-3XC5-WRHM-F963

Impact

Patches

Credit

GHSA-497X-RRR9-68JP

Tags

Sightings

Nomenclature