PT-2026-7910 · Unknown+2 · Prometheus+2

Thegameprofi · Published 2026-02-12 · Updated 2026-02-15 · CVE-2026-26069

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions Scraparr versions 3.0.0-beta through 3.0.1

Description Scraparr, a Prometheus Exporter for the *arr Suite, disclosed Readarr API keys when the Readarr integration was enabled. This occurred because the exporter exposed the configured Readarr API key as the alias metric label value. The issue affected users if Readarr scraping was enabled with no alias configured, the exporter’s /metrics endpoint was accessible to external or unauthorized users, and the Readarr instance was externally accessible. If the /metrics endpoint was publicly accessible, the Readarr API key could be disclosed via exported metrics data. The vulnerable parameter is the alias metric label value.

Recommendations Upgrade to version 3.0.2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-26069

GHSA-HX24-222F-W5CJ

Affected Products

Prometheus

Readarr

Scraparr

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26069.json · Exploit
• https://github.com/thecfu/scraparr/commit/194116bb8fb0b6ea26421b3e7a7b326973f56cd0 · Patch
• https://github.com/thecfu/scraparr/security/advisories/GHSA-hx24-222f-w5cj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26069 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26069 · Vendor Advisory
• https://github.com/thecfu/scraparr/releases/tag/v3.0.2 · Note
• https://twitter.com/0dayPublishing/status/2023156548663447896 · Twitter Post
• https://twitter.com/CVEnew/status/2022069305815290000 · Twitter Post