CVE-2021-31232

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.

• https://community.grafana.com/c/security-announcementsThird Party Advisory
• https://github.com/cortexproject/cortexThird Party Advisory
• https://github.com/cortexproject/cortex/pull/4129/filesPatch, Third Party Advisory
• https://lists.cncf.io/g/cortex-users/message/50Release Notes, Vendor Advisory
• https://community.grafana.com/c/security-announcementsThird Party Advisory
• https://github.com/cortexproject/cortexThird Party Advisory
• https://github.com/cortexproject/cortex/pull/4129/filesPatch, Third Party Advisory
• https://lists.cncf.io/g/cortex-users/message/50Release Notes, Vendor Advisory

Published

Apr 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31225SES Evolution before 2.1.0 allows deleting some resources no…7.3
• CVE-2021-31226An issue was discovered in HCC embedded InterNiche 4.0.1. A …9.8
• CVE-2021-31227An issue was discovered in HCC embedded InterNiche 4.0.1. A …7.5
• CVE-2021-31228An issue was discovered in HCC embedded InterNiche 4.0.1. Th…7.5
• CVE-2021-31229An issue was discovered in libezxml.a in ezXML 0.8.6. The fu…6.5
• CVE-2021-31231The Alertmanager in Grafana Enterprise Metrics before 1.2.1 …5.5
• CVE-2021-31233SQL Injection vulnerability found in Fighting Cock Informati…7.5
• CVE-2021-31239An issue found in SQLite SQLite3 v.3.35.4 that allows a remo…7.5
• CVE-2021-3124Stored cross-site scripting (XSS) in form field in robust.sy…5.4
• CVE-2021-31240An issue found in libming v.0.4.8 allows a local attacker to…7.8
• CVE-2021-31245omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier…5.9
• CVE-2021-31249A CRLF injection vulnerability was found on BF-430, BF-431, …6.5