Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119566Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects

Medium 4.8

In plain English

A medium-severity security flaw in prometheus from prometheus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-prometheus-commonno fix listedDEBIAN-CVE-2026-119566
Debian:13golang-github-prometheus-commonno fix listedDEBIAN-CVE-2026-119566
Debian:14golang-github-prometheus-common0.69.0-1DEBIAN-CVE-2026-119566
Ubuntu:22.04:LTSgolang-github-prometheus-commonno fix listedUBUNTU-CVE-2026-119566
Ubuntu:24.04:LTSgolang-github-prometheus-commonno fix listedUBUNTU-CVE-2026-119566
Ubuntu:26.04:LTSgolang-github-prometheus-commonno fix listedUBUNTU-CVE-2026-119566

Affected products (as reported)

VendorProductVersions
prometheus prometheus 0 – through 3.15.1

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References