Prometheus vulnerabilities

Products

• Prometheus 7
• Blackbox Exporter 2

Newest

• prometheus Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects CVE-2026-119566 Fix available 6.3 MediumOctober 30, 2026
• prometheus Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI CVE-2026-44903 Fix available 5.1 MediumMay 5, 2026
• prometheus, red hat file integrity operator, logging for red hat openshift 6 +53 more +55 more Prometheus: remote read endpoint allows denial of service via crafted snappy payload CVE-2026-42154 Public exploitFix available 7.5 HighMay 4, 2026
• prometheus, red hat custom metric autoscaler operator for red hat openshift, file integrity operator +52 more +54 more Prometheus Azure AD remote write OAuth client secret exposed via config API CVE-2026-42151 Fix available 7.5 HighMay 4, 2026
• prometheus Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer CVE-2026-40179 Public exploitFix available 5.3 MediumApril 13, 2026
• prometheus alertmanager, debian linux +1 more Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint CVE-2023-40577 Fix available 7.5 HighAugust 23, 2023
• prometheus blackbox exporter Withdrawn Advisory: Access control issues in blackbox_exporter CVE-2023-26735 Disputed 7.5 HighApril 25, 2023
• prometheus exporter toolkit, exporter-toolkit +1 more Prometheus Exporter Toolkit vulnerable to basic authentication bypass CVE-2022-46146 Fix available 6.2 MediumNovember 29, 2022
• fedoraproject extra packages for enterprise linux, fedora, prometheus client golang +1 more +3 more Uncontrolled Resource Consumption in promhttp CVE-2022-21698 Fix available 7.5 HighFebruary 15, 2022
• prometheus Arbitrary redirects under /new endpoint CVE-2021-29622 Fix available EPSS 19.6% 6.5 MediumMay 19, 2021
• prometheus blackbox exporter ** DISPUTED ** Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE:... CVE-2020-16248 Fix availableDisputed 5.8 MediumAugust 9, 2020
• [unknown] prometheus, redhat openshift container platform +1 more Withdrawn Advisory: Prometheus XSS Vulnerability CVE-2019-3826 Fix available 6.1 MediumMarch 26, 2019