PT-2026-32579 · Unknown · Prometheus

Published 2026-04-13 · Updated 2026-05-21 · CVE-2026-40179

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Prometheus versions 3.0 through 3.5.1 Prometheus versions 3.6.0 through 3.11.1

Description Stored cross-site scripting exists in multiple components of the Prometheus web UI, specifically within the Mantine UI and the old React UI. The issue occurs because metric names and label values are injected into innerHTML without proper escaping. In both UIs, chart tooltips on the Graph page render metric names containing HTML or JavaScript without sanitization. Additionally, in the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. Since Prometheus v3.x defaults to UTF-8 metric and label name validation, characters such as <, >, and " are considered valid. An attacker capable of injecting metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of a user viewing the metric in the Graph UI. This could lead to configuration exfiltration via '/api/v1/status/config', data deletion via '/api/v1/admin/tsdb/delete series', or Prometheus shutdown via '/-/quit', depending on the enabled flags.

Recommendations Update Prometheus versions 3.0 through 3.5.1 to version 3.5.2. Update Prometheus versions 3.6.0 through 3.11.1 to version 3.11.2. Ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources. Verify that all scrape targets are trusted and not under attacker control. Avoid enabling admin or mutating API endpoints, such as --web.enable-admin-api or --web.enable-lifecycle, in environments where untrusted data may be ingested. Refrain from clicking untrusted links, particularly those containing functions such as label replace, as they may generate poisoned label names and values.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-PROMETHEUS-2026-40179

CLEANSTART-2026-AP95632

CLEANSTART-2026-AX33738

CLEANSTART-2026-JF61842

CLEANSTART-2026-MP82813

CLEANSTART-2026-MV81821

CLEANSTART-2026-OX06093

CLEANSTART-2026-PM88731

CLEANSTART-2026-QI02196

CLEANSTART-2026-QS87161

CLEANSTART-2026-SE34232

CLEANSTART-2026-TL66481

CVE-2026-40179

GHSA-VFFH-X6R8-XX99

OPENSUSE-SU-2026:10607-1

Affected Products

Prometheus

References · 159

• https://github.com/prometheus/prometheus/commit/07c6232d159bfb474a077788be184d87adcfac3c · Patch
• https://github.com/prometheus/prometheus/pull/18506 · Patch
• https://github.com/prometheus/prometheus/security/advisories/GHSA-vffh-x6r8-xx99 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33815 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68119 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68121 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-40179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34986 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27143 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-SE34232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39882 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-QS87161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note