Read the docs
TI-2021-14576 Aliases CVE-2021-36157GHSA-jphm-g89m-v42p

An issue was discovered in Grafana Cortex through 1.9.0.

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)

Why it matters now

EPSS 0.01392 72nd percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/cortexproject/cortex (Go)up to 1.9.0—No fix listedGHSA-jphm-g89m-v42p
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/cortexproject/cortex (Go) Vendor— Affected up to 1.9.0 Fixed in — No fix listed GHSA-jphm-g89m-v42p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:cortex:*:*:*:*:*:*:*:*up to 1.9.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:cortex:*:*:*:*:*:*:*:* Versions up to 1.9.0 Vulnerable ·backstage

Remediation

Red Hat 2 advisories

  • RHSA-2023:5006 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2023:3304 Released 2023-05-30 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/network-tools-rhel8, openshift4/oc-mirror-plugin-rhel8 +42

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:3304
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5006
Not affected: 8 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-36157
  2. 2026-10-03 Alias added: GHSA-jphm-g89m-v42p

References

Patch 1

Advisory 2

Other 3

  • TI-2022-07591 Alertmanager can expose local files content via specially crafted config CVSS 3.1MEDIUM 6.5
  • TI-2021-11443 The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences