Prometheus vulnerabilities
3 known CVE vulnerabilities in Prometheus, translated and rated.
- CVE-2026-44903Medium
Prometheus from version 2.49.0 to before 3.5.3 and 3.11.3 contains an XSS vulnerability in the legacy web UI (enabled via --enable-feature=old-ui). In the histogram heatmap chart view, 'le' label values are not properly escaped, allowing an attacker to inject JavaScript via crafted metrics.
- CVE-2026-42154High
Prometheus before versions 3.5.3 and 3.11.3 does not validate the declared decoded length in a snappy-compressed request to the /api/v1/read endpoint before allocating memory. An unauthenticated attacker can send a small payload causing a huge heap allocation, potentially exhausting memory and crashing the Prometheus process under concurrent load.
- CVE-2026-42151High
Prometheus prior to versions 3.5.3 and 3.11.3 stores the client_secret field in Azure AD OAuth configuration as a plain string instead of a Secret. This exposes the Azure OAuth client secret in plaintext to any user or process with access to the /-/config endpoint.