CVE-2026-81938

Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: httpheaders..files and basicauth.usernamefile. A tenant permitted to upload an Alertmanager configuration could point these fields at any...