Every CVE Search/ Get API key

CVE-2026-40179

Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

5.3 MediumPublic exploitFix available

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.31%Up 0.3 points since Apr 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

Record
CVE-2026-40179
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-23123 5.3

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

Record
EUVD-2026-23123
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vffh-x6r8-xx99 5.3

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact

Stored cross-site scripting (XSS) via crafted metric names in the Prometheus web UI:

  • Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script execution in the user's browser.
  • Old React UI only: When a user opens the Metric Explorer (globe icon next to the PromQL expression input field), and a metric name containing HTML/JavaScript is rendered in the fuzzy search results, it is injected into innerHTML without escaping, causing arbitrary script execution in the user's browser.
  • Old React UI only: When a user views a heatmap chart and hovers over a cell, the le label values of the underlying histogram buckets are interpolated into innerHTML without escaping. While le is conventionally a numeric bucket boundary, Prometheus does not enforce this — arbitrary UTF-8 strings are accepted as label values, allowing script injection via a crafted scrape target or remote write.

With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels, making this exploitable.

An attacker who can inject metrics (via a compromised scrape target, remote write, or OTLP receiver endpoint) can execute JavaScript in the browser of any Prometheus user who views the metric in the Graph UI. From the XSS context, an attacker could for example:

  • Read /api/v1/status/config to extract sensitive configuration (although credentials / secrets are redacted by the server)
  • Call /-/quit to shut down Prometheus (only if --web.enable-lifecycle is set)
  • Call /api/v1/admin/tsdb/delete_series to delete data (only if --web.enable-admin-api is set)
  • Exfiltrate metric data to an external server

Both the new Mantine UI and the old React UI are affected. The vulnerable code paths are:

  • web/ui/mantine-ui/src/pages/query/uPlotChartHelpers.ts — tooltip innerHTML with unescaped labels.__name__
  • web/ui/react-app/src/pages/graph/GraphHelpers.ts — tooltip content with unescaped labels.__name__
  • web/ui/react-app/src/pages/graph/MetricsExplorer.tsx — fuzzy search results rendered via dangerouslySetInnerHTML without sanitization
  • web/ui/react-app/src/vendor/flot/jquery.flot.heatmap.js — heatmap tooltip with unescaped label values

Patches

A patch has been published in Prometheus 3.5.2 LTS and Prometheus 3.11.2. The fix applies escapeHTML() to all user-controlled values (metric names and label values) before inserting them into innerHTML. This advisory will be updated with the patched version once released.

Workarounds

  • If using the remote write receiver (--web.enable-remote-write-receiver), ensure it is not exposed to untrusted sources.
  • If using the OTLP receiver (--web.enable-otlp-receiver), ensure it is not exposed to untrusted sources.
  • Ensure scrape targets are trusted and not under attacker control.
  • Do not enable admin / mutating API endpoints (e.g. --web.enable-admin-api or web.enable-lifecycle) in cases where you cannot prevent untrusted data from being ingested.
  • Users should avoid clicking untrusted links, especially those containing functions such as label_replace, as they may generate poisoned label names and values.

References

  • CVE-2019-10215 — prior stored DOM XSS vulnerability in Prometheus query history, fixed in v2.7.2

Acknowledgements

Thanks to @gladiator9797 (Duc Anh Nguyen from TinyxLab) for reporting this.

Record
GHSA-vffh-x6r8-xx99
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.3

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

Record
CVE-2026-40179
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVALPINE-CVE-2026-40179 6.1

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

Record
ALPINE-CVE-2026-40179
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSV 5.3

Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

Record
CVE-2026-40179
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
Show 11 moreShow less
OSVGHSA-vffh-x6r8-xx99 5.3

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact

Stored cross-site scripting (XSS) via crafted metric names in the Prometheus web UI:

  • Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script execution in the user's browser.
  • Old React UI only: When a user opens the Metric Explorer (globe icon next to the PromQL expression input field), and a metric name containing HTML/JavaScript is rendered in the fuzzy search results, it is injected into innerHTML without escaping, causing arbitrary script execution in the user's browser.
  • Old React UI only: When a user views a heatmap chart and hovers over a cell, the le label values of the underlying histogram buckets are interpolated into innerHTML without escaping. While le is conventionally a numeric bucket boundary, Prometheus does not enforce this — arbitrary UTF-8 strings are accepted as label values, allowing script injection via a crafted scrape target or remote write.

With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels, making this exploitable.

An attacker who can inject metrics (via a compromised scrape target, remote write, or OTLP receiver endpoint) can execute JavaScript in the browser of any Prometheus user who views the metric in the Graph UI. From the XSS context, an attacker could for example:

  • Read /api/v1/status/config to extract sensitive configuration (although credentials / secrets are redacted by the server)
  • Call /-/quit to shut down Prometheus (only if --web.enable-lifecycle is set)
  • Call /api/v1/admin/tsdb/delete_series to delete data (only if --web.enable-admin-api is set)
  • Exfiltrate metric data to an external server

Both the new Mantine UI and the old React UI are affected. The vulnerable code paths are:

  • web/ui/mantine-ui/src/pages/query/uPlotChartHelpers.ts — tooltip innerHTML with unescaped labels.__name__
  • web/ui/react-app/src/pages/graph/GraphHelpers.ts — tooltip content with unescaped labels.__name__
  • web/ui/react-app/src/pages/graph/MetricsExplorer.tsx — fuzzy search results rendered via dangerouslySetInnerHTML without sanitization
  • web/ui/react-app/src/vendor/flot/jquery.flot.heatmap.js — heatmap tooltip with unescaped label values

Patches

A patch has been published in Prometheus 3.5.2 LTS and Prometheus 3.11.2. The fix applies escapeHTML() to all user-controlled values (metric names and label values) before inserting them into innerHTML. This advisory will be updated with the patched version once released.

Workarounds

  • If using the remote write receiver (--web.enable-remote-write-receiver), ensure it is not exposed to untrusted sources.
  • If using the OTLP receiver (--web.enable-otlp-receiver), ensure it is not exposed to untrusted sources.
  • Ensure scrape targets are trusted and not under attacker control.
  • Do not enable admin / mutating API endpoints (e.g. --web.enable-admin-api or web.enable-lifecycle) in cases where you cannot prevent untrusted data from being ingested.
  • Users should avoid clicking untrusted links, especially those containing functions such as label_replace, as they may generate poisoned label names and values.

References

  • CVE-2019-10215 — prior stored DOM XSS vulnerability in Prometheus query history, fixed in v2.7.2

Acknowledgements

Thanks to @gladiator9797 (Duc Anh Nguyen from TinyxLab) for reporting this.

Record
GHSA-vffh-x6r8-xx99
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVROOT-APP-GOBINARY-CVE-2026-40179 6.1

CVE-2026-40179 in rootio-github.com/prometheus/prometheus - Patched by Root

Root has patched CVE-2026-40179 in the rootio-github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available.

Record
ROOT-APP-GOBINARY-CVE-2026-40179
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-40179 5.3

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

Record
UBUNTU-CVE-2026-40179
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVBIT-prometheus-2026-40179 No score

Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

Record
BIT-prometheus-2026-40179
Updated
2026-11-02
OSVGO-2026-5662 No score

Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Record
GO-2026-5662
Updated
2026-11-02
OSVopenSUSE-SU-2026:10607-1 No score

golang-github-prometheus-prometheus-3.11.2-1.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-3.11.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10607-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
  • GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
  • GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
  • GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
  • GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
  • GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
  • GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
  • GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
  • GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
  • GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
  • GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
  • GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
  • GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
  • GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
  • GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
  • GO-2026-5933 GHSA-3g4q-2f67-2gvh
  • GO-2026-5934 GHSA-59qp-cfj3-rp64
  • GO-2026-5935 GHSA-7856-g3gv-9wq8
  • GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
  • GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
  • GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
  • GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
  • GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
  • GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
  • GO-2026-5942 CVE-2026-46600
  • GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
  • GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
  • GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
  • GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
  • GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
  • GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
  • GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
  • GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
  • GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
  • GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
  • GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
  • GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
  • GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
  • GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
  • GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
  • GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
  • GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
  • GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
  • GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
  • GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
  • GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
  • GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
  • GO-2026-5969 GHSA-g936-7jqj-mwv8
  • GO-2026-5970 CVE-2026-56852
  • GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
  • GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
  • GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
  • GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
  • GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
  • GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
  • GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
  • GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
  • GO-2026-5981 GHSA-mqxv-9rm6-w8qc
  • GO-2026-5982 GHSA-pqg7-v6wh-3pfp
  • GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
  • GO-2026-5985 GHSA-7rx3-5wx3-5v76
  • GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
  • GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
  • GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
  • GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
  • GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
  • GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
  • GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
  • GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
  • GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
  • GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
  • GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
  • GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
  • GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
  • GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
  • GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
  • GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
Record
openSUSE-SU-2026:21483-1
Updated
2026-11-02
OSVSUSE-SU-2026:2243-1 No score

Security update 5.0.8 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

  • Security Fixes:

    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)

golang-github-prometheus-node_exporter:

  • Backward Compatibility and packaging changes:

    • Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
    • Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility

  • Version 1.10.2:

    • Fixed typo in Zswap metric name (meminfo)

  • Version 1.10.1:

    • Fixed mount points being collected multiple times (filesystem)
    • Refactored mountinfo parsing (bsc#1261810)
    • Added Zswap/Zswapped metrics (meminfo)

  • Version 1.10.0:

    • New collectors: PCIe devices, swaps
    • Added systemd virtualization metrics, AIX metrics
    • WiFi packet metrics, additional PCIe and TLB metrics
    • Changed mdadm to use sysfs, added erofs to excluded filesystems
    • Fixed bugs: cpufreq collector, ethtool metrics

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987).
    • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
      • Bump google.golang.org/grpc to version 1.79.3
    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      • Bump rollup to version 4.59.0

  • Other changes:

    • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit.
    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)

prometheus-postgres_exporter:

  • Security Fixes:

    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987)
    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)

  • Highlights of other changes and bug fixes:

    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy

grafana was updated from version 11.6.11 to 11.6.14+security01:

  • Security Fixes:

    • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Highlights of other changes and bug fixes:

    • Version 11.6.13:

      • Wire the public dashboard service to the HTTP server

    • Version 11.6.12:

      • Update authentication redirect logic
      • Fixed single panel render with variable references

spacecmd:

  • Version…
Record
SUSE-SU-2026:2243-1
Updated
2026-11-02
OSVSUSE-SU-2026:2265-1 No score

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:

This is a codestream only update

Record
SUSE-SU-2026:2265-1
Updated
2026-11-02
OSVSUSE-SU-2026:2768-1 No score

Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues:

dracut-saltboot updated to version 1.2.1:

  • Key Update Highlights (v1.2.1)
    • Added wait check for minion start (default 10s), configurable using rd.saltboot.salt_start_timeout option (bsc#1260870)
    • Decouple salt key wait check to use separate configurable option rd.saltboot.salt_key_timeout, with default 60s
    • Introduce rd.saltboot namespace for all options, mark old as deprecated

golang-github-QubitProducts-exporter_exporter:

  • Security issues fixed:
    • CVE-2022-21698: Fixed prometheus/client_golang possible denial of service using InstrumentHandlerCounter (bsc#1248699)

golang-github-boynux-squid_exporter:

  • Non customer facing changes

golang-github-lusitaniae-apache_exporter:

  • Non customer facing changes

golang-github-prometheus-alertmanager:

  • Non customer facing changes

golang-github-prometheus-node_exporter updated to version 1.10.2:

  • Key Update Highlights (v1.10.0 to v1.10.2):
    • New Collectors: Added new collectors for PCIe devices and swaps.
    • New Metrics: Introduced metrics for Zswap/Zswapped, Systemd Virtualization, and WiFi packets (received/transmitted)
    • Bug Fixes: Resolved a duplicate collection bug in filesystem mount points, fixed a Zswap metric typo, and patched a logging race condition in systemd.
    • Changes: Switched mdadm to use sysfs for RAID metrics, and added erofs to the default excluded filesystems list.
    • Internal Refactoring: filesystem mountinfo parsing refactor (bsc#1261810)

golang-github-prometheus-prometheus updated to version 3.5.3:

  • Security issues fixed:

    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (v3.5.3) (bsc#1263986)
    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the limit (v3.5.3) (bsc#1263987)
    • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (v3.5.2) (bsc#1262222).
    • CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (backported patch) (bsc#1266608)

  • Other changes:

    • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (v3.5.3)
    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)
    • Internal update with non customer facing changes (v3.5.1)

grafana updated to version 11.6.14+security-04:

  • Security issues fixed in v11.6.14+security-04:
    • CVE-2026-28374: Fixed insecure direct object reference in Annotations API (bsc#1265290)
    • CVE-2026-28376: Fixed unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
    • CVE-2026-28383: Fixed unbounded memory allocation in Grafana plugin resources (bsc#1265286)
    • CVE-2026-28380: Fixed broken access control in Snapshot API (bsc#1265287)
    • CVE-2026-33376: Fixed Auth Proxy IPv6 whitelist bypass (bsc#1265285)
    • CVE-2026-28379: Fixed viewer-triggered race condition in Grafana Live (bsc#1265288)
    • CVE-2026-33377: Fixed dashboard Editor Privilege Escalation (bsc#1265284)
    • CVE-2026-33378: Fixed OOM exception in Grafana Data Source Plugin (bsc#1265283)
    • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
    • CVE-2026-33380: Fixed vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)
  • Security issues fixed through backported patches:
    • CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)
    • CVE-2026-34986: Fixed panic in JWE decryption (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Fixed multiple issues when…
Record
SUSE-SU-2026:2768-1
Updated
2026-11-02
OSVSUSE-SU-2026:2774-1 No score

Security update 5.1.4 for Multi-Linux Manager Server

This update fixes the following issues:

Release Notes Highlights:

  • Update to SUSE Multi-Linux Manager 5.1.4
    • Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions
    • Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0
    • SUSE Liberty Linux 9.6 Support
    • New API Endpoint - listMigrationTargetsWithChannels
    • Debian 12 End-of-Life Notice
    • SUSE Registry URL Change
    • Security fixes: CVE-2026-34986, CVE-2026-41602, CVE-2026-39821, CVE-2026-42198 CVE-2022-21698, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154 CVE-2026-28374, CVE-2026-28376, CVE-2026-28379, CVE-2026-28380 CVE-2026-28383, CVE-2026-33376, CVE-2026-33377, CVE-2026-33378 CVE-2026-33380, CVE-2026-33381
    • Bugs mentioned: bsc#1226578, bsc#1234567, bsc#1238890, bsc#1242916, bsc#1245107 bsc#1247707, bsc#1248699, bsc#1249243, bsc#1253032, bsc#1257583 bsc#1257894, bsc#1258041, bsc#1258079, bsc#1258144, bsc#1258382 bsc#1258816, bsc#1259087, bsc#1259230, bsc#1259261, bsc#1259474 bsc#1259479, bsc#1259482, bsc#1259521, bsc#1259590, bsc#1259591 bsc#1259700, bsc#1259739, bsc#1259787, bsc#1259960, bsc#1260031 bsc#1260614, bsc#1260806, bsc#1261305, bsc#1261307, bsc#1261327 bsc#1261631, bsc#1261723, bsc#1261753, bsc#1261841, bsc#1261902 bsc#1262090, bsc#1262285, bsc#1262460, bsc#1262471, bsc#1262492 bsc#1262595, bsc#1262708, bsc#1262720, bsc#1262761, bsc#1263814 bsc#1263841, bsc#1264149, bsc#1264234, bsc#1264256, bsc#1264966 bsc#1265134, bsc#1265319, bsc#1265358, bsc#1265975, bsc#1266012 bsc#1262950, bsc#1263501, bsc#1266600, bsc#1266556, bsc#1264174 bsc#1262222, bsc#1263986, bsc#1263987, bsc#1265290, bsc#1265289 bsc#1265288, bsc#1265287, bsc#1265286, bsc#1265285, bsc#1265284 bsc#1265283, bsc#1265282, bsc#1265281, bsc#1269253, bsc#1269534

Container images and uyuni-tools changes:

server-attestation-image:

  • Version 5.1.15
    • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-hub-xmlrpc-api-image:

  • Version 5.1.14
    • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-image:

  • Version 5.1.15
    • Healthcheck on disk usage based on taskomatic (bsc#1238890)
    • Added mozilla-nss-sysinit to Dockerfile required for FIPS (bsc#1247707)
    • Do not get repositories from SCC in the server container (bsc#1242916)
    • Added 'susemanager-tools', 'susemanager' and 'susemanager-tools-salt' packages to server-image

server-migration-14-16-image:

  • Version 5.1.14
    • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-postgresql-image:

  • Version 5.1.13
    • Healthcheck on disk usage based on taskomatic (bsc#1238890)
    • Added needed pg_hba rules on upgrade (bsc#1262492, bsc#1264149)

server-saline-image:

  • Version 5.1.14
    • Use python3*-tornado6 package to make it working with Python 3.11

uyuni-tools:

  • Version 5.1.29-0 Check backup status only after database is started (bsc#1262492)
  • Version 5.1.28-0
    • Remove waitForTraefik function (bsc#1261902)
    • Fix inspect: missing registry for db image (bsc#1259739)
    • Preserve hub replicas during upgrade (bsc#1262708)
    • Stop automatically unhealthy container
    • Ignore spacewalk-service stop return code.
    • Use correct CA for Report DB (bsc#1260806)
    • Do not call podman healthcheck run to wait for pods to be ready (bsc#1266012)

The following packages are underlying build dependencies and system components used by the containers:

cobbler:

  • Added the distro signature for rhel10 (bsc#1265134)

liberate-formula:

  • Version 0.1.4
    • No customer facing changes
  • Version 0.1.3
    • Liberate formula support for EL10 (bsc#1265975)

prometheus-exporters-formula:

  • Version 1.4.3
    • Added support for Python 3.13
    • Drop migrate_formula_data script as it is obsolete

prometheus-postgres_exporter:

-…

Record
SUSE-SU-2026:2774-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/prometheus/prometheus
Go
 3.0.0 to 3.5.1
3.5.2
github.com/prometheus/prometheus
Go
 3.6.0 to 3.11.1
3.11.2
github.com/prometheus/prometheus
Go
 before 0.311.2-0.20260410083055-07c6232d159b
0.311.2-0.20260410083055-07c6232d159b
prometheus
Alpine:v3.23
 3.0.0 up to 3.5.3-r0
3.5.3-r0
prometheus
Alpine:v3.24
 3.0.0 up to 3.5.3-r0
3.5.3-r0
prometheus
Bitnami
 before 0.305.2, 0.306.0 up to 0.311.2, 1.0.0 up to 3.5.2, 3.6.0 up to 3.11.2
0.305.20.311.23.5.23.11.2
github.com/prometheus/prometheus
Go
 3.0.0 up to 3.5.2
3.5.2
github.com/prometheus/prometheus
Go
 3.6.0 up to 3.11.2
3.11.2
rootio-github.com/prometheus/prometheus
Root:Go
 before v0.303.0-root.io.1
v0.303.0-root.io.1v0.303.0-root.io.2v0.308.1-root.io.1v0.303.0-root.io.5v0.308.1-root.io.3
github.com/prometheus/prometheus
Root:Go
 before v0.303.0-aikido.5
v0.303.0-aikido.5v0.308.1-aikido.3
Show 78 moreShow less
Affected packages
PackageAffectedFixed
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-QubitProducts-exporter_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.4.0-150002.3.6.2
0.4.0-150002.3.6.2
golang-github-boynux-squid_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.13.0-150002.3.6.2
1.13.0-150002.3.6.2
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.0.10-150002.3.9.2
1.0.10-150002.3.9.2
golang-github-prometheus-alertmanager
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.28.1-150002.4.11.1
0.28.1-150002.4.11.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 3.5.3-150002.3.13.1
3.5.3-150002.3.13.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 11.6.14+security04-150002.4.21.1
11.6.14+security04-150002.4.21.1
mgr-push
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.4-150002.3.9.1
5.2.4-150002.3.9.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.26.0-150002.3.11.1
0.26.0-150002.3.11.1
prometheus-postgres_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.10.1-150002.3.3.2
0.10.1-150002.3.3.2
python-defusedxml-sle15
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.7.1-150002.1.3.1
0.7.1-150002.1.3.1
rhnlib
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.5-150002.3.9.1
5.2.5-150002.3.9.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.8-150002.3.12.1
5.2.8-150002.3.12.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.6-150002.3.9.1
5.2.6-150002.3.9.1
supportutils-plugin-salt
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.2.3-150002.3.3.1
1.2.3-150002.3.3.1
supportutils-plugin-susemanager-client
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.3-150002.3.9.1
5.2.3-150002.3.9.1
uyuni-common-libs
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.5-150002.3.6.1
5.2.5-150002.3.6.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-aarch64-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-s390x-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-s390x-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-s390x-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-x86_64-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
uyuni-tools
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.29-150700.3.26.1
5.1.29-150700.3.26.1
suse-multi-linux-manager-5.1-aarch64-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-aarch64-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-aarch64-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-aarch64-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
suse-multi-linux-manager-5.1-ppc64le-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-ppc64le-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-ppc64le-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
suse-multi-linux-manager-5.1-s390x-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-s390x-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-s390x-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-s390x-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
suse-multi-linux-manager-5.1-x86_64-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-x86_64-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-x86_64-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-x86_64-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
uyuni-tools
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.29-150700.3.26.1
5.1.29-150700.3.26.1
prometheus
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.14.0+ds-10.16.2+ds-10.16.2+ds-1ubuntu1
 None known
prometheus
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.7.1+ds-11.8.1+ds-22.1.0+ds-1
 None known
prometheus
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.7.1+ds-32.15.2+ds-2
 None known
prometheus
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.24.1+ds-1ubuntu12.24.1+ds-1ubuntu22.31.1+ds2-22.31.2+ds1-12.31.2+ds1-1ubuntu1
Show 6 moreShow less
2.31.2+ds1-1ubuntu1.22.04.12.31.2+ds1-1ubuntu1.22.04.22.31.2+ds1-1ubuntu1.22.04.32.31.2+ds1-1ubuntu1.22.04.3+esm12.31.2+ds1-1ubuntu1.22.04.3+esm22.31.2+ds1-1ubuntu1.22.04.3+esm3
 None known
prometheus
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.45.0+ds-3build12.45.1+ds-12.45.1+ds-22.45.1+ds-32.45.3+ds-2
Show 8 moreShow less
2.45.3+ds-2build12.45.3+ds-2ubuntu0.12.45.3+ds-2ubuntu0.22.45.3+ds-2ubuntu0.2+esm12.45.3+ds-2ubuntu0.2+esm22.45.3+ds-2ubuntu0.32.45.3+ds-2ubuntu0.3+esm12.45.3+ds-2ubuntu0.3+esm2
 None known
prometheus
Ubuntu:25.10
 All versions, plus listed versions
2.53.3+ds1-12.53.3+ds1-2
 None known
prometheus
Ubuntu:26.10
 All versions, plus listed versions
2.53.5+ds1-33.5.3+ds1-33.5.3+ds1-5
 None known
prometheus
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.53.3+ds1-22.53.5+ds1-22.53.5+ds1-32.53.5+ds1-3ubuntu0.26.04.1~esm1
 None known
golang-github-prometheus-prometheus
openSUSE:Tumbleweed
 before 3.11.2-1.1
3.11.2-1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubbsdrip/CVE-2026-40179-PoC2026-08-19

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40179 is a medium vulnerability (CVSS 5.3) in Prometheus, published April 13, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in github.com/prometheus/prometheus 3.5.2.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,683 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open