TI-2022-07591 Aliases CVE-2022-23536 GHSA-cq2g-pw6q-hf7j

Alertmanager can expose local files content via specially crafted config

LOW 30CWE-184Published 2022-12-19 · Updated 2025-04-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-73 and the CVSS impact.

Summary

Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00817 57th percentileScored 2026-11-07

Fix Fixed github.com/cortexproject/cortex (Go): 1.14.1, 1.13.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cortexproject	cortex	1.13.0 – 1.13.1; = 1.14.0	—	No fix listed	CNA
—	github.com/cortexproject/cortex (Go)	1.14.0 to before 1.14.1	1.14.1	Patch available	GHSA-cq2g-pw6q-hf7j
—	github.com/cortexproject/cortex (Go)	1.13.0 to before 1.13.2	1.13.2	Patch available	GHSA-cq2g-pw6q-hf7j

cortex Vendorcortexproject Affected 1.13.0 – 1.13.1; = 1.14.0 Fixed in — No fix listed CNA
github.com/cortexproject/cortex (Go) Vendor— Affected 1.14.0 to before 1.14.1 Fixed in 1.14.1 Patch available GHSA-cq2g-pw6q-hf7j
github.com/cortexproject/cortex (Go) Vendor— Affected 1.13.0 to before 1.13.2 Fixed in 1.13.2 Patch available GHSA-cq2g-pw6q-hf7j

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:cortex:1.13.0:::::::*	1.13.0	Vulnerable	backstage
cpe:2.3:a:linuxfoundation:cortex:1.13.1:::::::*	1.13.1	Vulnerable	backstage
cpe:2.3:a:linuxfoundation:cortex:1.14.0:::::::*	1.14.0	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:cortex:1.13.0:*:*:*:*:*:*:* Versions 1.13.0 Vulnerable ·backstage
cpe:2.3:a:linuxfoundation:cortex:1.13.1:*:*:*:*:*:*:* Versions 1.13.1 Vulnerable ·backstage
cpe:2.3:a:linuxfoundation:cortex:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·backstage

Remediation

Fix · GHSA-cq2g-pw6q-hf7j github.com/cortexproject/cortex (Go) Fixed in 1.14.1 Advisory →
Fix · GHSA-cq2g-pw6q-hf7j github.com/cortexproject/cortex (Go) Fixed in 1.13.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 7 products

Logging Subsystem for Red Hat OpenShift
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift Container Platform 4
Red Hat Openshift Container Storage 4
Red Hat Openshift Data Foundation 4

Timeline

2026-10-02 Threatist record created from CVE-2022-23536
2026-10-03 Alias added: GHSA-cq2g-pw6q-hf7j

References

Advisory 5

Other 3

TI-2021-14576 An issue was discovered in Grafana Cortex through 1.9.0. CVSS 3.1MEDIUM 5.3
TI-2021-11443 The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences