Medium severity5.5NVD Advisory· Published Apr 30, 2021· Updated Jun 17, 2026
CVE-2021-31232
CVE-2021-31232
Description
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/cortexproject/cortexGo | < 1.8.1 | 1.8.1 |
Affected products
3- CNCF/Cortexdescription
Patches
Vulnerability mechanics
References
5- github.com/cortexproject/cortex/pull/4129/filesnvdPatchThird Party AdvisoryWEB
- community.grafana.com/c/security-announcementsnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-m45g-f45x-vv22ghsaADVISORY
- lists.cncf.io/g/cortex-users/message/50nvdRelease NotesVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-31232ghsaADVISORY
News mentions
0No linked articles in our index yet.