{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://thepeoples.io/oci/hardened/alloy/v1.20.1-tpio.1/openvex.json","author":"thepeoples.io hardened-oci","timestamp":"2026-10-13T10:30:00Z","version":1,"statements":[{"vulnerability":{"name":"CVE-2026-21726","aliases":["GHSA-497x-rrr9-68jp","GO-2026-5115"]},"products":[{"@id":"oci.thepeoples.io/hardened/alloy:v1.20.1-tpio.1"},{"@id":"pkg:golang/github.com/grafana/loki/v3@v3.0.0-20260915071729-5cf8c23a258d"}],"status":"not_affected","justification":"vulnerable_code_not_present","impact_statement":"The vendor advisory concerns path traversal in the Loki Ruler rules API. This exact Alloy parent contains 20 Loki log-processing, syntax, statistics, cache, utility and generated queryrange definition packages; no pkg/ruler package is in its complete compiled dependency graph. This is code absence, not a claim that the pseudo-version is patched. Alloy source revision 95e12cf8961fabc9db6858f7e79bde5c814a07a0; parent binary SHA256 8aa090b18e1ec2a0cf51b9b3b650008cd54308799c302b9d7e3b23925428dc62; compiled package graph SHA256 959929ec554e1189bc60dbe43e69c0b30a2345c42e3aaca5f49b644943244a11 in source records/packages.txt. Exact module version v3.0.0-20260915071729-5cf8c23a258d. Reference: https://grafana.com/security/security-advisories/cve-2026-21726/."}]}