CVE-2021-36157

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)

• CWE-22

• https://github.com/cortexproject/cortex/pull/4375Patch, Third Party Advisory
• https://grafana.com/docs/grafana/latest/release-notes/Release Notes, Vendor Advisory
• https://github.com/cortexproject/cortex/pull/4375Patch, Third Party Advisory
• https://grafana.com/docs/grafana/latest/release-notes/Release Notes, Vendor Advisory

Published

Aug 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36151In Apache Gobblin, the Hadoop token is written to a temp fil…5.5
• CVE-2021-36152Apache Gobblin trusts all certificates used for LDAP connect…9.8
• CVE-2021-36153Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC …7.5
• CVE-2021-36154HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier al…7.5
• CVE-2021-36155LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier …7.5
• CVE-2021-36156An issue was discovered in Grafana Loki through 2.2.1. The h…5.3
• CVE-2021-36158In the xrdp package (in branches through 3.14) for Alpine Li…5.9
• CVE-2021-36159libfetch before 2021-07-26, as used in apk-tools, xbps, and …9.1
• CVE-2021-3616A vulnerability was reported in Lenovo Smart Camera X3, X5, …9.8
• CVE-2021-36160A carefully crafted request uri-path can cause mod_proxy_uws…7.5
• CVE-2021-36161Some component in Dubbo will try to print the formated strin…9.8
• CVE-2021-36162Apache Dubbo supports various rules to support configuration…8.8