What is the CVSS score of CVE-2026-42129?

CVE-2026-42129 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Grafana CVE-2026-42129

EUVD-2026-38241 HIGH

Path Traversal (CWE-22)

N/A vendor:alpine

GHSA-f74p-cwhp-x2wx

Grafana Path Traversal Loki Datasource

7.7

CVSS 3.1 · Vendor: vendor:alpine

Severity by source

Vendor (vendor:alpine) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (vendor:alpine) · only source for this CVE.

CVSS VectorVendor: vendor:alpine

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Jun 22, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jun 22, 2026 - 14:22 NVD

7.7 (HIGH)

Analysis Generated

Jun 13, 2026 - 12:01 vuln.today

DescriptionCVE.org

Alpine Linux: grafana fixed in 12.4.4-r0

AnalysisAI

Grafana, as packaged in Alpine Linux, contains a vulnerability fixed in package version 12.4.4-r0. The upstream Grafana version addressed is 12.4.4. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Unknown prerequisites

Exploit

Trigger unknown vulnerability in Grafana

Impact

Achieve unknown impact

Access

Unknown prerequisites

Exploit

Trigger unknown vulnerability in Grafana

Impact

Achieve unknown impact

Vulnerability AssessmentAI

Exploitation	Exploitation conditions cannot be determined from the available data. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Risk cannot be meaningfully assessed from the available data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An exploit scenario cannot be constructed from the available data. The attack vector, required privileges, and vulnerability class are all unknown. …
Remediation	Upgrade the Grafana package on Alpine Linux to version 12.4.4-r0 or later using the standard Alpine package manager: 'apk upgrade grafana'. … Detailed patch versions, workarounds, and compensating controls in full report.