PT-2026-7910 · Unknown+2 · Prometheus+2

Thegameprofi · Publicado 2026-02-12 · Atualizado 2026-02-15 · CVE-2026-26069

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Crítica

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions Scraparr versions 3.0.0-beta through 3.0.1

Description Scraparr, a Prometheus Exporter for the *arr Suite, disclosed Readarr API keys when the Readarr integration was enabled. This occurred because the exporter exposed the configured Readarr API key as the alias metric label value. The issue affected users if Readarr scraping was enabled with no alias configured, the exporter’s /metrics endpoint was accessible to external or unauthorized users, and the Readarr instance was externally accessible. If the /metrics endpoint was publicly accessible, the Readarr API key could be disclosed via exported metrics data. The vulnerable parameter is the alias metric label value.

Recommendations Upgrade to version 3.0.2 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-26069

GHSA-HX24-222F-W5CJ

Produtos afetados

Prometheus

Readarr

Scraparr

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26069.json · Exploit
• https://github.com/thecfu/scraparr/commit/194116bb8fb0b6ea26421b3e7a7b326973f56cd0 · Correção
• https://github.com/thecfu/scraparr/security/advisories/GHSA-hx24-222f-w5cj · Aviso do Fabricante
• https://github.com/thecfu/scraparr/releases/tag/v3.0.2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-26069 · Nota de Segurança
• https://twitter.com/0dayPublishing/status/2023156548663447896 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2022069305815290000 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26069 · Aviso do Fabricante