Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Loki could let attackers read monitoring data
published 12 days ago
Summary
The Loki component used with Prometheus may allow unauthorized users to view your monitoring information. This could expose internal system details and performance metrics. Apply the latest updates for Loki and restrict access to the monitoring endpoints.
What to do
- Update cleanstart loki to version 3.5.12-r7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | loki |
< 3.5.12-r7 Fix: upgrade to 3.5.12-r7
|
Original advisory text
Prometheus is an open-source monitoring system and time series database
Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published24 Oct 2026
Updated24 Oct 2026
First seen24 Oct 2026
Sources
CLEANSTART-2026-WT48121 · OSV
Track software like this
Free during beta