Read the docs
TI-2026-83928 Aliases CVE-2026-81938GHSA-243g-h4f6-prqr

Arbitrary file read via Alertmanager config in Grafana Mimir

Priority LOW 34CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Grafana Mimir from 3.0.4 before 3.1.7 and from 3.2.0 before 3.2.2, and Grafana Enterprise Metrics (GEM) from 2.11.0 through 2.16.2 and from 2.17.0 before 2.17.20, are affected. The Alertmanager receiver check misses the http_headers and basic_auth.username_file settings, so a path traversal flaw (CWE-22) lets a tenant read any file the Alertmanager process can access. A tenant allowed to write its Alertmanager configuration can have the file contents sent to a server it controls.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration. Exploitation requires permission to write the tenant's Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00393 33rd percentileScored 2026-11-07
Fix Fixed Enterprise Metrics (GEM) (Grafana): 2.17.20Grafana Mimir (Grafana): 3.1.7, 3.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GrafanaEnterprise Metrics (GEM)2.11.0 – 2.16.2; 2.17.0 to before 2.17.202.17.20Patch availableCNA
GrafanaGrafana Mimir3.0.4 to before 3.1.7; 3.2.0 to before 3.2.23.1.7, 3.2.2Patch availableCNA
  • Enterprise Metrics (GEM) VendorGrafana Affected 2.11.0 – 2.16.2; 2.17.0 to before 2.17.20 Fixed in 2.17.20 Patch available CNA
  • Grafana Mimir VendorGrafana Affected 3.0.4 to before 3.1.7; 3.2.0 to before 3.2.2 Fixed in 3.1.7, 3.2.2 Patch available CNA

Remediation

Upgrade Grafana Mimir to 3.1.7 or 3.2.2, and Grafana Enterprise Metrics (GEM) to 2.17.20. The sources list no fixed version for Grafana Enterprise Metrics (GEM) 2.11 through 2.16. Users on those versions should upgrade to 2.17.20 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA Enterprise Metrics (GEM) (Grafana) Fixed in 2.17.20
  • Fix · CNA Grafana Mimir (Grafana) Fixed in 3.1.7, 3.2.2

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-81938
  2. 2026-11-02 CISA SSVC decision points changed
  3. 2026-11-02 Priority changed: MEDIUM → LOW
  4. 2026-11-02 Alias added: GHSA-243g-h4f6-prqr

References

Advisory 1

  • TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
  • TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
  • TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
  • TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
  • TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
See all 174 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences