The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL
    decode, by double encoding, an attacker can read files at the Ruler API endpoint
    /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.
    (CVE-2026-21726)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL     decode, by double encoding, an attacker can read files at the Ruler API endpoint     /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.
    (CVE-2026-21726)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463946	Echo: github.com/grafana/loki/v3: security update to 3.6.4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463946	Echo: github.com/grafana/loki/v3: security update to 3.6.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
440921	SCA: security update for github.com/grafana/loki/v3 (GHSA-497x-rrr9-68jp)	Tenable Cloud Security	SCA Checks	Local	medium
440921	SCA: security update for github.com/grafana/loki/v3 (GHSA-497x-rrr9-68jp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
307378	Linux Distros Unpatched Vulnerability : CVE-2026-21726	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-21726

medium

Tenable Plugins

medium

medium

medium

medium

medium