What’s Vulnerable › Vulnerabilities

CVE-2021-31232

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-30 · updated 2026-06-17

Description

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.

Affected products

• cortexproject cortex: before 1.8.1 — fixed in 1.8.1

How to fix

Upgrade to a fixed version: cortexproject cortex 1.8.1. Check the vendor advisory for mitigations.

References

• https://community.grafana.com/c/security-announcements
• https://github.com/cortexproject/cortex
• https://github.com/cortexproject/cortex/pull/4129/files
• https://lists.cncf.io/g/cortex-users/message/50
• https://community.grafana.com/c/security-announcements
• https://github.com/cortexproject/cortex
• https://github.com/cortexproject/cortex/pull/4129/files
• https://lists.cncf.io/g/cortex-users/message/50

Get alerted when CVE-2021-31232 or the next vulnerability affects your stack