CLEANSTART-2026-LK99645 Security fixes for CVE-2026-2303, CVE-2026-27145, CVE-2026-42504, CVE-2026-42507 applied in versions: 0.88.1-r1, 0.88.1-r2

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HD68184 Security fixes for CVE-2026-2303, CVE-2026-42504, ghsa-cp6g-7hqx-qxhp applied in versions: 3.11.3-r2, 3.11.3-r3

Multiple security vulnerabilities affect the prometheus package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OS58683 Security fixes for CVE-2026-42504 applied in versions: 3.11.3-r2

Security vulnerability affects the prometheus package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LP13983 Security fixes for CVE-2026-2303, CVE-2026-42504, ghsa-cp6g-7hqx-qxhp applied in versions: 3.10.0-r3, 3.10.0-r4, 3.10.0-r5

Multiple security vulnerabilities affect the prometheus package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KS96802 Security fixes for CVE-2026-39822, CVE-2026-42505 applied in versions: 3.5.3-r4

Multiple security vulnerabilities affect the prometheus package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KL21881 Security fixes for CVE-2026-39822, CVE-2026-42505, CVE-2026-46600, CVE-2026-56852 applied in versions: 3.9.1-r7, 3.9.1-r8

Multiple security vulnerabilities affect the prometheus package. These issues are resolved in later releases. See references for individual vulnerability details...

[SECURITY] Fedora 43 Update: node-exporter-1.12.1-1.fc43

Prometheus exporter for hardware and OS metrics exposed by NIX kernels, writ ten in Go with pluggable metric collectors...

CVE-2026-49835

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an...

DEBIAN-CVE-2026-49835

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an...

CVE-2026-49835 Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an...

CVE-2026-49835 Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an...

GHSA-X8MG-6R4P-87PF ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

About 14 HTTP handlers resolve the database path param and call getDatabase... WITHOUT user.canAccessToDatabase... and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler which holds the only per-database gate at...

github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint

A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint /api/v1/read by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service DoS...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

BIT-PROMETHEUS-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write OAuth configuration storage/remote/azuread was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving...

BIT-PROMETHEUS-2026-40179 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

Important: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 4.4.2 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

[SECURITY] Fedora 43 Update: prometheus-3.13.1-1.fc43

The Prometheus monitoring system and time series database...

[SECURITY] Fedora 44 Update: prometheus-3.13.1-1.fc44

The Prometheus monitoring system and time series database...

BIT-PROMETHEUS-2026-42154 Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint /api/v1/read does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a sma...