HighCVSS 8.7
A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.
Vendor
cortexproject vulnerabilities
4 published CVES affecting cortexproject, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 4
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unscored
- 1
- CISA KEV
- 0
Products
Latest cortexproject CVEs
Newest publication first
-
-
MediumCVSS 6.5
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations...
-
MediumCVSS 5.5 EPSS 0.37%
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be u...
-
Unknown EPSS 1.4%
An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.