{"cve":"CVE-2022-23536","nvd":{"published":"2022-12-19T22:15:10.803","modified":"2026-06-17T04:30:18.753","status":"Modified","description":"Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-73","CWE-184","CWE-641"],"references":["https://cortexmetrics.io/docs/api/#set-alertmanager-configuration","https://github.com/cortexproject/cortex/releases/tag/v1.13.2","https://github.com/cortexproject/cortex/releases/tag/v1.14.1","https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j","https://cortexmetrics.io/docs/api/#set-alertmanager-configuration"],"products":["linuxfoundation:cortex"],"source":"nvd","synced_at":"2026-10-19T21:37:31.370122805+00:00"},"epss":{"cve":"CVE-2022-23536","score":0.00817,"percentile":0.57151,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-cq2g-pw6q-hf7j","url":"https://osv.dev/vulnerability/GHSA-cq2g-pw6q-hf7j","summary":"Cortex's Alertmanager can expose local files content via specially crafted config","modified":"2023-11-08T04:08:21.294648Z","packages":[{"ecosystem":"Go","name":"github.com/cortexproject/cortex","purl":"pkg:golang/github.com/cortexproject/cortex","ranges":[">=1.14.0 <1.14.1"],"fixed":["1.14.1"]},{"ecosystem":"Go","name":"github.com/cortexproject/cortex","purl":"pkg:golang/github.com/cortexproject/cortex","ranges":[">=1.13.0 <1.13.2"],"fixed":["1.13.2"]}]},{"id":"GO-2022-1175","url":"https://osv.dev/vulnerability/GO-2022-1175","summary":"Exposure of local files in github.com/cortexproject/cortex","modified":"2024-05-20T16:03:47Z","packages":[{"ecosystem":"Go","name":"github.com/cortexproject/cortex","purl":"pkg:golang/github.com/cortexproject/cortex","ranges":[">=1.13.0 <1.13.2",">=1.14.0 <1.14.1"],"fixed":["1.13.2","1.14.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}