Prometheus - Open Redirect

Prometheus 2.23.0 through 2.26.0 and 2.27.0 contains an open redirect vulnerability. To ensure a seamless transition to 2.27.0, the default UI was changed to the new UI with a URL prefixed by /new redirect to /. Due to a bug in the code, an attacker can redirect a user to a malicious site and...

Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)

Prometheus Blackbox Exporter through 0.17.0 contains a server-side request forgery caused by unsanitized target parameter in /probe, letting attackers perform SSRF attacks, exploit requires sending crafted target parameter. id: CVE-2020-16248 info: name: Prometheus Blackbox Exporter - Server-Side...

ayaFlow

ayaFlow ayaFlow is a Rust + eBPF network traffic analyzer built with Aya. It runs one agent per Linux node, attaches a TC classifier at ingress and egress, and exposes live traffic data, historical SQLite-backed history, and Prometheus metrics. What It Does Captures IPv4, IPv6, TCP, and UDP traff...

CVE-2026-42154

CVE-2026-42154 CVE-2026-42154 — Prometheus Remote Read Snappy DoS...

loki

Loki: like Prometheus, but for logs. Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. It is designed to be very cost effective and easy to operate. It does not index the contents of the logs, but rather a set of labels for each log...

prometheus

Installing Prometheus Prometheus is a Ruby application and will run on any system running a recent version 1.8.7 or higher of Ruby. To install Prometheus use the following steps: 1. Create a directory called prometheus. 2. Extract the prometheus files into the directory. 3. CD into the prometheus...

CVE-2026-40179-PoC

CVE-2026-40179 — Prometheus stored XSS via remotewrite A minimal, dependency-light proof of concept for CVE-2026-40179 GHSA-vffh-x6r8-xx99: stored cross-site scripting in the Prometheus web UI, delivered through an unauthenticated remotewrite endpoint. The vulnerability Prometheus 3.x renders...

prometheus-bearer-redirect

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · prometheus-bearer-redirect Write-up: https://abraxaslabs.tech/research/prometheus-bearer-redirect prometheus-bearer-redirect Class: Credential leak Reach: Remote Prometheus v3.15.0 5241a27 - CNCF / Prometheus...

prometheus-unix-socket-dial

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · prometheus-unix-socket-dial Write-up: https://abraxaslabs.tech/research/prometheus-unix-socket-dial prometheus-unix-socket-dial Class: SSRF Reach: Remote Prometheus v3.15.0 5241a27 - CNCF / Prometheus v3.15.0 added Un...

CVE-2026-106472

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

CVE-2026-106472 Server-side request forgery in the Prometheus data source resource API

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

EUVD-2026-124571

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

CVE-2026-106472

The Grafana Prometheus data source is vulnerable to a Server-side Request Forgery (SSRF) due to a missing path allowlist. The application passes the resource path provided by the caller directly to the configured Prometheus server without restriction. Consequently, a user with permissions to quer...

PT-2026-145891

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

golang-github-prometheus-prometheus-3.15.0-2.1 on GA media (moderate)

golang-github-prometheus-prometheus-3.15.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:12285-1 Rating: moderate Cross-References: CVE-2026-93753 CVSS scores: CVE-2026-93753 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Tumbleweed An update that solves o...

CVE-2026-106472: Grafana: Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server…

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

Prommetrix

Info: Prommetrix is a free software tool to obtain relevant information from the instances of 'Node Exporter' executed by 'Prometheus'. Prometheus is an open-source, metrics-based event monitoring and alerting solution for cloud applications. It is used by nearly 800 cloud-native organizations...

suricata_exporter

Suricata Prometheus Exporter This is a Prometheus Exporter for Suricata using dump-counters via the unix socket to query metrics. Usage $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default "/var/run/suricata.socket" -versio...

CLEANSTART-2026-VZ13080 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the keda package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-FW57538 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the keda package. Prometheus is an open-source monitoring system and time series database...