CVE-2026-81938

Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: httpheaders..files and basicauth.usernamefile. A tenant permitted to upload an Alertmanager configuration could point these fields at any...

CVE-2026-81938 Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir

Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: httpheaders..files and basicauth.usernamefile. A tenant permitted to upload an Alertmanager configuration could point these fields at any...

EUVD-2026-115357

Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: httpheaders..files and basicauth.usernamefile. A tenant permitted to upload an Alertmanager configuration could point these fields at any...

CVE-2026-81938: Grafana: Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check…

Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: httpheaders. .files and basicauth.usernamefile. A tenant permitted to upload an Alertmanager configuration could point these fields at any...