Alertmanager 0.34.1 → 0.34.2
1 release · 0 breaking changes · 3 security fixes · 1 advisory fixed
3security0breaking0deprecated0feature0fix
Vulnerabilities fixed by this upgrade
- 7.6 GHSA-w5g2-x24w-p3fq Alertmanager API v2 allows cross-origin reads, alert creation and silence creation
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation in 0.34.2
- security [SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664 in 0.34.2
- security [SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943 in 0.34.2
Every release in between
securityFixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation
security[SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664
security[SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943