What is the CVSS score of EUVD-2026-23100?

EUVD-2026-23100 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-23100?

Yes, a patch is available for EUVD-2026-23100. Update the affected software to the latest version immediately.

Loki EUVD-2026-23100

| CVE-2026-21726 MEDIUM

Path Traversal (CWE-22)

2026-04-15 security@grafana.com

Path Traversal Loki

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 20, 2026 - 20:08 nvd

Patch available

Apr 16, 2026 - 05:29 EUVD

3.5.9

EUVD ID Assigned

Apr 15, 2026 - 20:22 euvd

EUVD-2026-23100

CVE Published

Apr 15, 2026 - 20:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}

Thanks to Prasanth Sundararajan for reporting this vulnerability.

Analysis

Thanks to Prasanth Sundararajan for reporting this vulnerability.

More in Loki

View all

CVE-2026-21729 HIGH This Week

7.5 Jul 16

Uncontrolled memory allocation in Grafana Loki lets remote unauthenticated users issue queries with excessively large li

CVE-2021-36156 MEDIUM This Month

5.3 Aug 03

An issue was discovered in Grafana Loki through 2.2.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

CVE-2018-13379 CRITICAL POC

9.1

CVE-2015-0016 HIGH POC

7.8

Same technique Path Traversal

View all

CVE-2025-64446 CRITICAL POC

9.8

CVE-2015-0016 HIGH POC

7.8

CVE-2016-0752 HIGH POC

7.5

CVE-2024-13159 CRITICAL POC

9.8

CVE-2024-13160 CRITICAL POC

9.8

CVE-2024-13161 CRITICAL POC

9.8

CVE-2014-0780 CRITICAL POC

9.8

CVE-2024-48248 HIGH POC

8.6

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Manager Client Tools 15	Fixed
SUSE Manager Client Tools for SLE 15	Fixed
SUSE Multi-Linux Manager Client Tools for SLE 15	Fixed
openSUSE Leap 15.6	Fixed

EUVD-2026-23100 vulnerability details – vuln.today

Back

Loki EUVD-2026-23100

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

More in Loki

Same weakness CWE-22 – Path Traversal

Same technique Path Traversal

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code