CVE-2026-81938

{
  "etk_id": "ETK-2026-3324",
  "cve_id": "CVE-2026-81938",
  "display_id": "CVE-2026-81938",
  "ghsa_id": "GHSA-243g-h4f6-prqr",
  "euvd_id": "EUVD-2026-115357",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary file read in Mimir and GEM Alertmanager",
  "summary": "Affected Grafana Mimir Alertmanager and Grafana Enterprise Metrics deployments can allow tenant-controlled receiver configuration to trigger reads of files accessible to the Alertmanager process. An authorized tenant could cause file contents to be sent in an outbound notification, exposing material such as service credentials or configuration data. The attacker must be able to modify that tenant's Alertmanager configuration.",
  "mitigation": "Upgrade Grafana Mimir to 3.1.7 or 3.2.2, and upgrade Grafana Enterprise Metrics to 2.17.20 or later. Until upgrades are complete, restrict tenant permission to edit Alertmanager configurations.",
  "vendor": "Grafana",
  "product": "Enterprise Metrics (GEM)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.11.0, <= 2.16.2",
        ">= 2.17.0, < 2.17.20"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.17.20"
      ],
      "package_name": "Enterprise Metrics (GEM)",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.4, < 3.1.7",
        ">= 3.2.0, < 3.2.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.1.7",
        "3.2.2"
      ],
      "package_name": "Grafana Mimir",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.839872,
  "t0_at": "2026-11-02T18:23:43.604000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T18:23:43.604000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T18:23:43.604000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81938"
    }
  }
}