StackRadar

CVE-2021-36157

Medium

Advisory

Published 2 Sept 2021In the index since 8 Sept 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
0.014
71st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
19
of 17,781 indexed, latest versions
Container images
17
deployed by those charts
Fix available
None
affected package

Path traversal in Grafana Cortex

Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 17 images.

Affected packageAffected versionsFixed inImages
github.com/cortexproject/cortexgolangv1.0.1-0.20200430170006-3462eb63f324, v1.2.1-0.20200812152417-a4aad5da5e4e, v1.4.1-0.20201022071705-85942c5703cf, v1.5.1-0.20201111110551-ba512881b076+3 moreno fix listed17
OSV records
GHSA-jphm-g89m-v42p

Charts affected

19 by stars
ChartLatestAffected imagesRadar Score
grafanaappscodeVerified publisher2026.9.111 of 1See more

grafana appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana:v2025.2.367d18880448c
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed

Open the chart page →

2,333
lokichoerodon0.29.01 of 1See more

loki choerodon 0.29.0

1 of the 1 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/loki:1.5.0922b3f412fdd
github.com/cortexproject/cortex@v1.0.1-0.20200430170006-3462eb63f324
no fix listed

Open the chart page →

2,869
promtailchoerodon0.23.01 of 1See more

promtail choerodon 0.23.0

1 of the 1 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/promtail:1.5.046e88d390cd6
github.com/cortexproject/cortex@v1.0.1-0.20200430170006-3462eb63f324
no fix listed

Open the chart page →

2,821
grafana-agentdandydev-chartsVerified publisher0.19.21 of 1See more

grafana-agent dandydev-charts 0.19.2

1 of the 1 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/agent:v0.20.0825c09373d27
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed

Open the chart page →

3,238
kube-prometheus-stackdevtron19.3.01 of 6See more

kube-prometheus-stack devtron 19.3.0

1 of the 6 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/grafana:8.2.500568d89c4f8
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed

Open the chart page →

8,645
kube-prometheus-stackdevtron-labs19.3.01 of 6See more

kube-prometheus-stack devtron-labs 19.3.0

1 of the 6 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/grafana:8.2.500568d89c4f8
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed

Open the chart page →

8,645
grafana-dashboardsdysnixVerified publisher0.2.21 of 2See more

grafana-dashboards dysnix 0.2.2

1 of the 2 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/grafana:7.4.5d322192ed2fa
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed

Open the chart page →

5,161
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
governify/dashboard:lateste83a17ba5038
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed

Open the chart page →

22,512
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
governify/dashboard:lateste83a17ba5038
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed

Open the chart page →

24,319
lokikube-opsVerified publisher1.7.31 of 1See more

loki kube-ops 1.7.3

1 of the 1 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
quay.io/kube-ops/loki:2.2.14fbd63194674
github.com/cortexproject/cortex@v1.6.1-0.20210204145131-7dac81171c66
no fix listed

Open the chart page →

2,646
promtailkube-opsVerified publisher1.5.11 of 2See more

promtail kube-ops 1.5.1

1 of the 2 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
quay.io/kube-ops/promtail:2.2.134de6387233b
github.com/cortexproject/cortex@v1.6.1-0.20210204145131-7dac81171c66
no fix listed

Open the chart page →

4,149
pulsarkubesphere-stable2.7.131 of 3See more

pulsar kubesphere-stable 2.7.13

1 of the 3 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.0.1611bceacec8fb
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed

Open the chart page →

14,320
kommandermesosphere-stable0.39.23 of 29See more

kommander mesosphere-stable 0.39.2

3 of the 29 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
thanosio/thanos:v0.19.088276fcd1491
github.com/cortexproject/cortex@v1.7.1-0.20210224085859-66d6fb5b0d42
no fix listed
thanosio/thanos:v0.15.0b12d5c31bf5a
github.com/cortexproject/cortex@v1.2.1-0.20200812152417-a4aad5da5e4e
no fix listed
quay.io/thanos/thanos:v0.17.1e362f02ed304
github.com/cortexproject/cortex@v1.5.1-0.20201111110551-ba512881b076
no fix listed

Open the chart page →

68,284
opscruiseopenshift0.35.1002 of 11See more

opscruise openshift 0.35.100

2 of the 11 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/loki:2.0.077e138f81a8e
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed
grafana/promtail:2.0.05fd12edcc694
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed

Open the chart page →

8,201
kube-prometheus-stackromholdings19.3.01 of 6See more

kube-prometheus-stack romholdings 19.3.0

1 of the 6 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/grafana:8.2.500568d89c4f8
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed

Open the chart page →

8,645
icinga2-masterschmitzis0.2.01 of 6See more

icinga2-master schmitzis 0.2.0

1 of the 6 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/grafana:8.0.3696823fbc561
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed

Open the chart page →

3,731
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/grafana:7.5.609bb407e26ab
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed

Open the chart page →

16,506
lokit3n1.0.01 of 1See more

loki t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/loki:1.5.0922b3f412fdd
github.com/cortexproject/cortex@v1.0.1-0.20200430170006-3462eb63f324
no fix listed

Open the chart page →

2,869
promtailt3n1.0.01 of 1See more

promtail t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-36157.

Container imageDigestPackageFixed in
grafana/promtail:1.5.046e88d390cd6
github.com/cortexproject/cortex@v1.0.1-0.20200430170006-3462eb63f324
no fix listed

Open the chart page →

2,821

Container images carrying it

17 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
grafana/grafana:8.2.500568d89c4f8
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed
3
governify/dashboard:lateste83a17ba5038
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed
2
grafana/loki:1.5.0922b3f412fdd
github.com/cortexproject/cortex@v1.0.1-0.20200430170006-3462eb63f324
no fix listed
2
grafana/promtail:1.5.046e88d390cd6
github.com/cortexproject/cortex@v1.0.1-0.20200430170006-3462eb63f324
no fix listed
2
grafana/agent:v0.20.0825c09373d27
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed
1
grafana/grafana:7.5.609bb407e26ab
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed
1
grafana/grafana:8.0.3696823fbc561
github.com/cortexproject/cortex@v1.8.2-0.20210428155238-d382e1d80eaf
no fix listed
1
grafana/grafana:7.4.5d322192ed2fa
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed
1
grafana/loki:2.0.077e138f81a8e
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed
1
grafana/promtail:2.0.05fd12edcc694
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed
1
streamnative/apache-pulsar-grafana-dashboard-k8s:0.0.1611bceacec8fb
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed
1
thanosio/thanos:v0.19.088276fcd1491
github.com/cortexproject/cortex@v1.7.1-0.20210224085859-66d6fb5b0d42
no fix listed
1
thanosio/thanos:v0.15.0b12d5c31bf5a
github.com/cortexproject/cortex@v1.2.1-0.20200812152417-a4aad5da5e4e
no fix listed
1
ghcr.io/appscode/grafana:v2025.2.367d18880448c
github.com/cortexproject/cortex@v1.4.1-0.20201022071705-85942c5703cf
no fix listed
1
quay.io/kube-ops/loki:2.2.14fbd63194674
github.com/cortexproject/cortex@v1.6.1-0.20210204145131-7dac81171c66
no fix listed
1
quay.io/kube-ops/promtail:2.2.134de6387233b
github.com/cortexproject/cortex@v1.6.1-0.20210204145131-7dac81171c66
no fix listed
1
quay.io/thanos/thanos:v0.17.1e362f02ed304
github.com/cortexproject/cortex@v1.5.1-0.20201111110551-ba512881b076
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.