CVE-2026-81938
Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Grafana Mimir Alertmanager

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: Grafana Labs

Description
Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration. Exploitation requires permission to write the tenant's Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-81938

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Grafana Mimir's Alertmanager allows tenants to upload configurations but previously did not block references to local files in certain HTTP client settings. A tenant could exploit this by pointing http_headers.<name>.files or basic_auth.username_file at sensitive files on the Alertmanager host. When notifications are sent, the file contents are included in request headers, allowing the tenant to exfiltrate data like credentials or configuration files.

Detection Guidance

Check Grafana Mimir or Grafana Enterprise Metrics (GEM) versions for affected releases (Mimir 3.1.x before 3.1.7, 3.2.x before 3.2.2, or GEM 2.11-2.16). Review Alertmanager configurations for tenant-uploaded files referencing http_headers.<name>.files or basic_auth.username_file pointing to local files.

Impact Analysis

If you manage a Grafana Mimir or Grafana Enterprise Metrics (GEM) instance, a malicious tenant with configuration upload permissions could read sensitive files from the host system. This could expose credentials, internal configurations, or other confidential data, potentially leading to further attacks or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust if such breaches occur due to inadequate security controls.

Mitigation Strategies

Upgrade to fixed versions: Mimir 3.1.7 or 3.2.2, or GEM 2.17.20 or later. If using GEM 2.11-2.16, upgrade to 2.17.20+. Remove any tenant-uploaded Alertmanager configurations using the vulnerable http_headers or basic_auth.username_file settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81938. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...