Security Audit Uncovers Tenant Isolation Flaws in Cortex Open‑Source Time‑Series Store
What Happened – Quarkslab, commissioned by the Open Source Technology Improvement Fund (OSTIF), audited Cortex — an open‑source, multi‑tenant, horizontally‑scalable Prometheus long‑term storage solution. The review of commit b4f5cfc identified seven vulnerabilities (six medium, one low), including a tenant‑impersonation issue in the PushStream gRPC handler, a stored XSS, and sensitive‑information leakage via the /config endpoint. All findings have been remediated by the project maintainers.
Why It Matters for Compliance & Audit Readiness
- Multi‑tenant isolation is a core SOC 2 control (CC6 Confidentiality & CC5 Security); a breach of tenant boundaries would invalidate the “segregation of duties” evidence auditors expect.
- Continuous‑compliance programs must prove that isolation controls are designed, implemented, and regularly verified; the audit highlights the need for systematic control mapping and evidence collection.
- Verisq’s Control Mapping capability can ingest the remediation details, generate audit‑ready artifacts, and maintain a live trust‑center view of isolation‑control health.
Who Is Affected – Organizations that run Cortex (or similar open‑source time‑series stores) in SaaS, monitoring, or cloud‑infrastructure environments, spanning cloud‑infra, tech‑SaaS, and DevOps tooling sectors.
Recommended Actions
- Upgrade to the patched Cortex version referenced in the Quarkslab report.
- Map tenant‑isolation mechanisms to SOC 2 CC5/CC6 controls and capture remediation evidence in your compliance repository.
- Integrate automated tests that validate tenant segregation on every release pipeline.
- Document the audit findings and remediation steps as part of your continuous‑audit evidence set.
Technical Notes –
- V01 – Tenant impersonation via PushStream gRPC (medium severity, high impact) – allowed a malicious tenant to send data on behalf of another.
- V02 – Stored XSS (medium) – could execute arbitrary scripts in the Cortex UI.
- V03 – Sensitive information leakage (medium) – exposed credentials through
/config. - Additional issues: unbound Gzip decompression, uncontrolled protobuf memory allocation, unbounded gossip reads, and missing integrity checks on gossip packets.