CLEANSTART-2026-AA56293 Security fixes in fluent-bit-plugin-loki 3.6.5-r0

Package fluent-bit-plugin-loki version 3.6.5-r0 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-24051, CVE-2026-25679, CVE-2026-33186...

CLEANSTART-2026-JV70419 Security fixes in loki 3.6.12-r0

Package loki version 3.6.12-r0 fixes 4 vulnerabilities: CVE-2020-8911, CVE-2020-8912, CVE-2026-56852, CVE-2026-46600...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: loki3.7: loki3.7-3.7.4-0.1.hum1 aarch64, x8664 loki3.7-canary-3.7.4-0.1.hum1 aarch64, x8664 loki3.7-logcli-3.7.4-0.1.hum1 aarch64, x8664 loki3.7-3.7.4-0.1.hum1.src src...

CVE-2026-21729

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

EUVD-2026-44862

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

CVE-2026-21729 Loki detected_fields query limits results in unbounded memory allocation

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

CVE-2026-21729

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

CVE-2026-21729 Loki detected_fields query limits results in unbounded memory allocation

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

CVE-2026-21729

CVE-2026-21729 concerns Loki: queries with large limits can trigger large memory allocations, potentially affecting service availability depending on deployment. The available documents do not specify affected Loki versions, exact vulnerable components, or a remediation. It is not stated whether ...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: zarf-fips, commercial-expanso-edge, argocd-image-updater, flux-source-controller-fips, omnictl-multiarch, trivy, knative-kafka-broker, docker-machine-driver-harvester, trivy-fips, osv-scanner, omnictl-multiarch-fips, nemo, coder-fips, drone, knative-serving,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, pulumi-language-yaml, pulumi-language-java, dagger, prometheus, vault-benchmark, zarf, cilium, flux-source-controller, docker-cli-buildx, go-discover, rootlesskit, k3s, istio, melange, kine, kubernetes, gomplate, containerd,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: zot, snyk-cli, zarf, prometheus, mattermost, kubernetes-dashboard, k9s, cilium, flux-source-controller, rancher, kaf, k3s, fscrypt, gitea, istio, kine, kubernetes, helm, chisel, loki, osv-scanner, flux-image-automation-controller, cert-manager, cilium-cli,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, pulumi-language-java, dagger, prometheus, zarf, cilium, flux-source-controller, docker-cli-buildx, go-discover, k3s, istio, melange, kine, kubernetes, gomplate, containerd, guac, chezmoi, opentelemetry-collector, witness, argo-events, aactl,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: zot, snyk-cli, prometheus, mattermost, kubernetes-dashboard, cilium, rancher, docker-cli-buildx, kaf, k3s, fscrypt, istio, kine, kubernetes, helm, podman, loki, cert-manager, cilium-cli, buildah, containerd, prometheus-operator, nerdctl, flux, kyverno,...

BIT-GRAFANA-2026-10601 Path traversal in the Tempo and Loki data source plugins

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the...

GO-2026-5115 Grafana Loki Path Traversal - CVE-2021-36156 Bypass in github.com/grafana/loki

Grafana Loki Path Traversal - CVE-2021-36156 Bypass in github.com/grafana/loki...

SUSE CVE-2026-10601

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the...

CVE-2026-10601

A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...

CVE-2026-42129

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information...

CVE-2026-10601

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the...