# CVE-2026-81938: Grafana Mimir Alertmanager local file disclosure via receiver config

Source: https://junglewise.ai/threats/cve-2026-81938-grafana-mimir-s-alertmanager-rejects-tenant-supplied-receiver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-81938 · Severity: high · CVSS 7.7 · Published 2026-11-02

Grafana Mimir's Alertmanager component allows monitored systems to send alerts and notifications. A tenant with permission to configure alerting receivers could exploit incomplete validation to read arbitrary files from the Alertmanager server, potentially exposing credentials, configuration data, and other sensitive information stored locally.

Vendors: [Grafana](https://junglewise.ai/threats/vendors/grafana).

## Quick answers

**Is CVE-2026-81938 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81938 being exploited in the wild.

**How severe is CVE-2026-81938?** High severity, with a CVSS score of 7.7, published 2 November 2026.

**Which products and versions are affected?** Grafana Enterprise Metrics before 2.17.20; versions 2.11 through 2.16 will not receive a fix; Grafana Mimir before 3.1.7, 3.2.0 before 3.2.2.

**Is there a fix for CVE-2026-81938?** Yes: fixed in Mimir 3.1.7, 3.2.2; Grafana Enterprise Metrics 2.17.20. Until then: Restrict Alertmanager configuration upload permissions to trusted tenants only. Users on GEM 2.11 through 2.16 must upgrade to 2.17.20 or later; patches will not be released for those legacy versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81938 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-81938?** Check whether you run Grafana Enterprise Metrics or Grafana Mimir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Mimir 3.1.7, 3.2.2; Grafana Enterprise Metrics 2.17.20

Restrict Alertmanager configuration upload permissions to trusted tenants only. Users on GEM 2.11 through 2.16 must upgrade to 2.17.20 or later; patches will not be released for those legacy versions.

## Technical details

The Alertmanager validates receiver configurations to block references to local files, but two HTTP client settings (http_headers.<name>.files and basic_auth.username_file) were not covered by this check. A malicious tenant can point these fields at any file readable by the Alertmanager process; when a notification is sent to an attacker-controlled receiver, the file contents are included in the outgoing HTTP request headers, enabling arbitrary file read. The vulnerability requires tenant-level privileges to upload Alertmanager configuration.

## Affected products

- Grafana Mimir before 3.1.7, 3.2.0 before 3.2.2
- Grafana Enterprise Metrics before 2.17.20; versions 2.11 through 2.16 will not receive a fix

## Timeline

- 2026-11-02: disclosed

## References

- [https://grafana.com/security/security-advisories/cve-2026-81938](https://grafana.com/security/security-advisories/cve-2026-81938)