CVE-2021-36157

Grafana Cortex (through 1.9.0) is affected by CVE-2021-36157: an attacker can craft the X-Scope-OrgID header to cause directory traversal, causing Cortex to parse a rules file from a local path and reveal parts of the contents in error messages. There is also a note that other Cortex API requests...

CVE-2022-23536

The CVE-2022-23536 issue affects Cortex (multi-tenant storage for Prometheus) where a local file inclusion vulnerability exists in Cortex versions 1.13.0 , 1.13.1 , and 1.14.0 . A malicious actor could remotely read local files by submitting maliciously crafted Alertmanager configurations via the...

CVE-2021-31232

The CVE-2021-31232 issue affects Cortex’s Alertmanager before version 1.8.1. Root cause: when -experimental.alertmanager.enable-api is enabled, the HTTP basic auth password_file can be used as an attack vector to leak any file content via a webhook, and Alertmanager templates can load any text fi...