StackRadar

CVE-2026-21726

Medium

Advisory

Published 15 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
77
of 17,781 indexed, latest versions
Container images
74
deployed by those charts
Fix available
1 of 2
affected packages

Grafana Loki Path Traversal - CVE-2021-36156 Bypass

Carried by container images the latest versions of 77 of 17,781 indexed charts deploy, on 74 images.

Affected packageAffected versionsFixed inImages
github.com/grafana/loki/v3golangv0.0.0-20240918161252-659f5421dde1, v0.0.0-20241218164224-23b5fc2c9b1a, v3.0.0, v3.0.0-20240513110952-8622293f23b1+17 more3.6.443
github.com/grafana/lokigolangv1.6.0, v1.6.2-0.20201026154740-6978ee5d7387, v1.6.2-0.20210429132126-d88f3996eaa2, v1.6.2-0.20210520072447-15d417efe103+10 moreno fix listed31
OSV records
GHSA-497x-rrr9-68jpGO-2026-5115

Charts affected

77 by stars
ChartLatestAffected imagesRadar Score
mayastormayastorVerified publisher2.12.12 of 31See more

mayastor mayastor 2.12.1

2 of the 31 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/grafana/loki/v3@v3.0.0-20250218135905-f078e0e3f9b6
3.6.4
grafana/loki:3.4.258a6c186ce78
github.com/grafana/loki/v3@v3.4.2
3.6.4

Open the chart page →

21,064
prometheus-operatormesosphere12.11.131 of 8See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

11,689
kube-prometheus-stackmesosphere-stable75.9.11 of 7See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:12.0.2b5b59bfc7561
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

10,180
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:12.1.1a1701c218024
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

17,070
one-green-coreone-green-coreVerified publisher0.0.71 of 8See more

one-green-core one-green-core 0.0.7

1 of the 8 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:8.5.3ecc1b80b8ca2
github.com/grafana/loki@v1.6.2-0.20211015002020-7832783b1caa
no fix listed

Open the chart page →

9,558
soha-observabilityopensohaVerified publisher0.2.11 of 2See more

soha-observability opensoha 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/loki:3.7.487f0a0676737
github.com/grafana/loki/v3@v3.0.0-20260722033256-b318f2829f0a
3.6.4

Open the chart page →

336
lokiot-container-kit1.0.12 of 5See more

loki ot-container-kit 1.0.1

2 of the 5 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/loki:3.1.0d947e68a84d9
github.com/grafana/loki/v3@v3.1.0
3.6.4
grafana/promtail:3.0.0d3de3da9431c
github.com/grafana/loki/v3@v3.0.0
3.6.4

Open the chart page →

4,831
vm-standaloneot-container-kit0.0.41 of 6See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

3,378
stk-fluent-bit-loki-s3paxtecnologia0.2.01 of 6See more

stk-fluent-bit-loki-s3 paxtecnologia 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/loki:3.6.1144148ad243c0
github.com/grafana/loki/v3@v3.0.0-20260513074435-f7a4aa99e11c
3.6.4

Open the chart page →

3,739
npre-essentialsphntom0.1.601 of 22See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/promtail:2.7.0c16c710f7333
github.com/grafana/loki@v2.7.0
no fix listed

Open the chart page →

26,840
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/loki:3.3.28af2de1abbdd
github.com/grafana/loki/v3@v0.0.0-20241218164224-23b5fc2c9b1a
3.6.4

Open the chart page →

4,272
radar-grafanaradar-baseVerified publisher0.1.41 of 2See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:11.6.062d2b9d20a19
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

1,667
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/loki:3.6.3cd6e176883a9
github.com/grafana/loki/v3@v3.6.3
3.6.4

Open the chart page →

6,859
kube-prometheus-stackromholdings19.3.01 of 6See more

kube-prometheus-stack romholdings 19.3.0

1 of the 6 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:8.2.500568d89c4f8
github.com/grafana/loki@v1.6.2-0.20210520072447-15d417efe103
no fix listed

Open the chart page →

8,645
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

1,795
lokisb-helm-charts0.4.01 of 1See more

loki sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/loki:3.6.192bd5700577b
github.com/grafana/loki/v3@v3.6.1
3.6.4

Open the chart page →

803
promtailsb-helm-charts0.4.01 of 1See more

promtail sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/promtail:3.6.18dcfdf466da0
github.com/grafana/loki/v3@v3.6.1
3.6.4

Open the chart page →

2,202
icinga2-masterschmitzis0.2.01 of 6See more

icinga2-master schmitzis 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:8.0.3696823fbc561
github.com/grafana/loki@v1.6.2-0.20210520072447-15d417efe103
no fix listed

Open the chart page →

3,731
centralbrainsciencemeshVerified publisher0.0.31 of 5See more

centralbrain sciencemesh 0.0.3

1 of the 5 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:7.3.315b977f5207d
github.com/grafana/loki@v1.6.0
no fix listed

Open the chart page →

9,754
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

7,708
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

7,901
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

4,974
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:7.5.609bb407e26ab
github.com/grafana/loki@v1.6.2-0.20201026154740-6978ee5d7387
no fix listed

Open the chart page →

16,506
monitoringthl-chartsVerified publisher0.1.11 of 10See more

monitoring thl-charts 0.1.1

1 of the 10 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:8.5.042d3e6bc1865
github.com/grafana/loki@v1.6.2-0.20211015002020-7832783b1caa
no fix listed

Open the chart page →

18,908
tfy-lokitruefoundryVerified publisher0.1.62 of 2See more

tfy-loki truefoundry 0.1.6

2 of the 2 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/loki:2.9.1035b02acc6765
github.com/grafana/loki@v2.9.10
no fix listed
grafana/promtail:2.9.1063a2e57a5b14
github.com/grafana/loki@v2.9.10
no fix listed

Open the chart page →

2,813
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

4,526
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-21726.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/grafana/loki/v3@v3.2.1
3.6.4

Open the chart page →

9,381

Container images carrying it

74 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
grafana/loki:3.6.192bd5700577b
github.com/grafana/loki/v3@v3.6.1
3.6.4
1
grafana/loki:2.8.2b1da1d23037e
github.com/grafana/loki@v2.8.2
no fix listed
1
grafana/loki:3.6.3cd6e176883a9
github.com/grafana/loki/v3@v3.6.3
3.6.4
1
grafana/loki:3.7.6efd47c67f9ba
github.com/grafana/loki/v3@v3.0.0-20260805152243-5003600d7c78
3.6.4
1
grafana/loki-canary:3.0.028d7c00588aa
github.com/grafana/loki/v3@v3.0.0
3.6.4
1
grafana/loki-canary:3.1.039baf6d67f85
github.com/grafana/loki/v3@v3.1.0
3.6.4
1
grafana/loki-canary:2.9.24249db29b992
github.com/grafana/loki@v2.9.2
no fix listed
1
grafana/loki-canary:3.2.049e03f80d361
github.com/grafana/loki/v3@v0.0.0-20240918161252-659f5421dde1
3.6.4
1
grafana/loki-canary:2.9.6549a40203e97
github.com/grafana/loki@v2.9.6
no fix listed
1
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/grafana/loki/v3@v3.2.1
3.6.4
1
grafana/promtail:2.9.1063a2e57a5b14
github.com/grafana/loki@v2.9.10
no fix listed
1
grafana/promtail:3.5.165bfae480b57
github.com/grafana/loki/v3@v3.5.1
3.6.4
1
grafana/promtail:3.6.18dcfdf466da0
github.com/grafana/loki/v3@v3.6.1
3.6.4
1
grafana/promtail:2.7.0c16c710f7333
github.com/grafana/loki@v2.7.0
no fix listed
1
grafana/promtail:3.0.0d3de3da9431c
github.com/grafana/loki/v3@v3.0.0
3.6.4
1
intel/multimodal-data-visualization:3.03426deb77337
github.com/grafana/loki@v1.6.2-0.20211015002020-7832783b1caa
no fix listed
1
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/grafana/loki@v1.6.2-0.20220718071907-6bd05c9a4399
no fix listed
1
streamnative/apache-pulsar-grafana-dashboard-k8s:0.0.1611bceacec8fb
github.com/grafana/loki@v1.6.2-0.20201026154740-6978ee5d7387
no fix listed
1
ghcr.io/antnsn/mal-sync:v1.0.52f06e72cef36
github.com/grafana/loki/v3@v3.5.1
3.6.4
1
ghcr.io/appscode/grafana:v2025.2.367d18880448c
github.com/grafana/loki@v1.6.2-0.20201026154740-6978ee5d7387
no fix listed
1
ghcr.io/blind-oracle/cortex-tenant:v2.0.09f8896ffc15b
github.com/grafana/loki/v3@v3.5.4
3.6.4
1
ghcr.io/peak-scale/observability-tenancy/loki-proxy:0.4.1548e962d0061
github.com/grafana/loki/v3@v3.4.2
3.6.4
1
public.ecr.aws/groundcovercom/loki-proxy:0.1.1783d550ad813
github.com/grafana/loki@v1.6.2-0.20220718071907-6bd05c9a4399
no fix listed
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/grafana/loki/v3@v3.2.1
3.6.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.