CVE-2026-81938: Path Traversal
Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: httpheaders.<name>.files and basicauth.usernamefile. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration.
Exploitation requires permission to write the tenant's Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have permission to write a tenant's Alertmanager configuration. They also need to configure a receiver that sends notifications to a server they control.
When are file contents exposed?
The Alertmanager process reads the referenced file when it sends a notification. The contents are placed in an outgoing HTTP header, allowing the configured receiver endpoint to capture them.
Which versions should be updated?
Update Mimir to 3.1.7 or 3.2.2. Update GEM to 2.17.20; GEM 2.11 through 2.16 will not receive a fix and should be upgraded to 2.17.20 or later.