{"id":"CVE-2022-23536","aliases":["EUVD-2022-7604","GHSA-cq2g-pw6q-hf7j","GO-2022-1175"],"status":"published","title":"Alertmanager can expose local files content via specially crafted config","description":"Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00817,"percentile":0.57453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-184","CWE-641","CWE-73"],"published":"2022-12-19T21:09:05Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"Go","package":"github.com/cortexproject/cortex","fixed_in":["1.14.1","1.13.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cortexproject/cortex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"last_affected":"1.14.0"},{"fixed":"1.14.1"}]}],"versions":["1.14.0"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cortexproject/cortex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cortexproject/cortex","ranges":[{"type":"SEMVER","events":[{"introduced":"1.14.0"},{"fixed":"1.14.1"}]}],"versions":["1.14.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/cortexproject/cortex","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cortexproject/cortex","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"},{"introduced":"1.14.0"},{"fixed":"1.14.1"}]}]}],"products":[{"vendor":"cortexproject","product":"cortex"},{"vendor":"linuxfoundation","product":"cortex"},{"vendor":"mikado-themes","product":"cortex"}],"references":[{"url":"https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cortexmetrics.io/docs/api/#set-alertmanager-configuration","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://github.com/cortexproject/cortex/releases/tag/v1.13.2","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/cortexproject/cortex/releases/tag/v1.14.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23536","tags":["advisory"]},{"url":"https://github.com/cortexproject/cortex/commit/03e023d8b012887b31cc268d0d011b01e1e65506","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2022-1175","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cq2g-pw6q-hf7j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23536.json","tags":["advisory"]},{"url":"https://github.com/cortexproject/cortex","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-23536","title":"Alertmanager can expose local files content via specially crafted config","description":"Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.\n","status":"published","published":"2022-12-19T21:10:21.977Z","modified":"2025-04-16T18:23:07.694Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-73","CWE-184","CWE-641"],"updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-7604","description":"Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.\n","status":"published","published":"2022-12-19T21:10:21Z","modified":"2025-04-16T18:23:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:22.523469Z"}],"ghsa":[{"id":"GHSA-cq2g-pw6q-hf7j","title":"Cortex's Alertmanager can expose local files content via specially crafted config","description":"### Impact\n\nA local file inclusion vulnerability exists in Cortex versions v1.13.0, v1.13.1 and v1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the [Alertmanager Set Configuration API](https://cortexmetrics.io/docs/api/#set-alertmanager-configuration). Only users of the Cortex Alertmanager service using `-experimental.alertmanager.enable-api` or `enable_api: true` are affected.\n\n### Specific Go Packages Affected\ngithub.com/cortexproject/cortex/pkg/alertmanager\n\n### Patches\nAffected Cortex users are advised to upgrade to versions 1.13.2 or 1.14.1.\n\n### Workarounds\nPatching is ultimately advised. Using out-of-bound validation, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section and `opsgenie_api_key_file` in the `global` section before sending to the [Set Alertmanager Configuration API](https://cortexmetrics.io/docs/api/#set-alertmanager-configuration) as a workaround.\n\n### References\n- Fixed Versions:\n   - https://github.com/cortexproject/cortex/releases/tag/v1.14.1\n   - https://github.com/cortexproject/cortex/releases/tag/v1.13.2\n- https://cortexmetrics.io/docs/api/#set-alertmanager-configuration\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [cortex](https://github.com/cortexproject/cortex/issues/new/choose)\n* Email us at [cortex-team@googlegroups.com](mailto:cortex-team@googlegroups.com).\n","status":"published","published":"2022-12-19T21:09:05Z","modified":"2023-10-02T11:04:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-73","CWE-184","CWE-641"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2022-23536","description":"Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.\n","status":"published","published":"2022-12-19T22:15:10.803Z","modified":"2026-06-17T04:30:18.753Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-73","CWE-184","CWE-641"],"updated_at":"2026-11-02T14:07:34.031641Z"}],"osv":[{"id":"CVE-2022-23536","title":"Alertmanager can expose local files content via specially crafted config","description":"Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.\n","status":"published","published":"2022-12-19T21:10:21.977Z","modified":"2026-10-28T02:30:47.391758167Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-184","CWE-641","CWE-73"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"GHSA-cq2g-pw6q-hf7j","title":"Cortex's Alertmanager can expose local files content via specially crafted config","description":"### Impact\n\nA local file inclusion vulnerability exists in Cortex versions v1.13.0, v1.13.1 and v1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the [Alertmanager Set Configuration API](https://cortexmetrics.io/docs/api/#set-alertmanager-configuration). Only users of the Cortex Alertmanager service using `-experimental.alertmanager.enable-api` or `enable_api: true` are affected.\n\n### Specific Go Packages Affected\ngithub.com/cortexproject/cortex/pkg/alertmanager\n\n### Patches\nAffected Cortex users are advised to upgrade to versions 1.13.2 or 1.14.1.\n\n### Workarounds\nPatching is ultimately advised. Using out-of-bound validation, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section and `opsgenie_api_key_file` in the `global` section before sending to the [Set Alertmanager Configuration API](https://cortexmetrics.io/docs/api/#set-alertmanager-configuration) as a workaround.\n\n### References\n- Fixed Versions:\n   - https://github.com/cortexproject/cortex/releases/tag/v1.14.1\n   - https://github.com/cortexproject/cortex/releases/tag/v1.13.2\n- https://cortexmetrics.io/docs/api/#set-alertmanager-configuration\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [cortex](https://github.com/cortexproject/cortex/issues/new/choose)\n* Email us at [cortex-team@googlegroups.com](mailto:cortex-team@googlegroups.com).\n","status":"published","published":"2022-12-19T21:09:05Z","modified":"2023-11-08T04:08:21.294648Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-184","CWE-641","CWE-73"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"GO-2022-1175","title":"Exposure of local files in github.com/cortexproject/cortex","description":"A malicious actor could remotely read local files by submitting to the Alertmanager Set Configuration API maliciously crafted inputs. Only users of the Alertmanager service where \"-experimental.alertmanager.enable-api\" or \"enable_api: true\" is configured are affected.","status":"published","published":"2022-12-22T17:41:59Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}