Alertmanager 0.33.1 → 0.34.2
3 releases · 0 breaking changes · 3 security fixes · 1 advisory fixed
3security0breaking0deprecated10feature5fix
Vulnerabilities fixed by this upgrade
- 7.6 GHSA-w5g2-x24w-p3fq Alertmanager API v2 allows cross-origin reads, alert creation and silence creation
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation in 0.34.2
- security [SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664 in 0.34.2
- security [SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943 in 0.34.2
Every release in between
securityFixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation
security[SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664
security[SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943
fix[BUGFIX] inhibit: Fix several issues related to inhibitions that caused alerts to be improperly un-muted in some cases. #5542, #5449, #5559
other[CHANGE] notify: The reason label on alertmanager_notifications_failed_total now distinguishes authError (HTTP 401/403) and rateLimited (HTTP 429) from the generic clientError. Dashboards/alerts matching reason="clientError" for these codes must be updated. #5332
feature[FEATURE] Add optional templatable labels to alert routes. #5328
feature[FEATURE] eventrecorder: Add inhibit rule names to inhibition_muted_alert events. #5315
feature[FEATURE] eventrecorder: Add stdout output type. #5311
feature[FEATURE] silences: Add active, expired, and pending boolean filter parameters to GET /api/v2/silences to allow filtering silences by state server-side. #5406
feature[FEATURE] sns: Add aws external_id support in sigv4 configuration. #5157
feature[FEATURE] template: Add toDate and mustToDate functions. #5327
feature[ENHANCEMENT] doc: Add AlertmanagerClusterFailedPeers alertmanager-mixin. #5301
feature[ENHANCEMENT] doc: Add description for Rocketchat parameters in global config. #5181
feature[ENHANCEMENT] doc: Add top level tracing configuration key. #5314
fix[ENHANCEMENT] doc: Fix Alertmanager port in amtool config routes example. #5312
feature[ENHANCEMENT] eventrecorder: Add optional webhook batching. #5392
other[ENHANCEMENT] notify: The discord and webex integrations now report a failure reason on alertmanager_notifications_failed_total. #5332
other[ENHANCEMENT] ui: Improve responsiveness of UI when loading thousands of alerts. #5357
fix[BUGFIX] eventrecorder: Fixed a minor performance regression when the event recorder is enabled. #5307
fix[BUGFIX] msteamsv2: Inherit global proxy_url into partial http_config. #5379
fix[BUGFIX] webhook: Keep custom payload string values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #5304