This vulnerability in Grafana Loki 2.3.0 involves improper validation of the namespace parameter in the Ruler API endpoint (/loki/api/v1/rules/{namespace}). The previous fix (CVE-2021-36156) validated the parameter after a single URL decode, but by double encoding path traversal sequences, an attacker can bypass this validation and read arbitrary files. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or remediation level has been published by the vendor.

An attacker can exploit this vulnerability to read files on the server hosting Grafana Loki by bypassing namespace parameter validation through double URL encoding. This leads to limited confidentiality impact without affecting integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Loki Ruler API endpoint and monitor for suspicious requests involving encoded path traversal sequences. Avoid exposing the vulnerable API endpoint to untrusted networks.