CVE-2026-100525

The OpenClaw Prometheus diagnostics plugin @openclaw/diagnostics-prometheus before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective...

CVE-2026-100525 OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass

The OpenClaw Prometheus diagnostics plugin @openclaw/diagnostics-prometheus before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective...

CLEANSTART-2026-DS50998 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-BN60910 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-PK17685 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...

PT-2026-99162

Name of the Vulnerable Software and Affected Versions @openclaw/diagnostics-prometheus versions prior to 2026.9.3 Description The authenticated metrics endpoint fails to enforce the operator.read scope. In deployments utilizing identity-bearing Gateway authentication modes, such as trusted-proxy,...

CVE-2026-100525: Missing Authorization

The OpenClaw Prometheus diagnostics plugin @openclaw/diagnostics-prometheus before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective...

CLEANSTART-2026-NE14632 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-YT94569 Security fix for GHSA-8wmf-6v46-5gfg applied in: prometheus-operator 0.91.0-r7, prometheus-operator 0.92.1-r5

GHSA-8wmf-6v46-5gfg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DS09618 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

PT-2026-105241

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

PT-2026-105222

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

Fedora 45 : prometheus-podman-exporter (2026-8590121cf7)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8590121cf7 advisory. release v2.0.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

[SECURITY] Fedora 45 Update: prometheus-podman-exporter-2.0.0-1.fc45

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

CLEANSTART-2026-JD89615 Security fix for CVE-2021-29622 applied in: prometheus 2.27.1-r0, prometheus-fips 2.27.1-r0

CVE-2021-29622 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PO69653 Security fix for CVE-2022-46146 applied in: prometheus 2.40.4-r1, prometheus-fips 2.40.4-r1, prometheus-node-exporter 1.5.0-r0, prometheus-node-exporter-fips 1.5.0-r0

CVE-2022-46146 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RD73080 Security fix for GHSA-cgrx-mc8f-2prm applied in: eks-distro-kube-apiserver 1.34.2-r0, eks-distro-kube-apiserver-fips 1.34.2-r0, eks-distro-kube-controller-manager-fips 1.34.2-r0, kaniko 1.24.0-r0, kaniko-fips 1.24.0-r0, local-static-provisioner 2.6.0-r1, local-static-provisioner-fips 2.6.0-r1, local-static-provisioner-fips 2.7.0-r1, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.10.2-r1, prometheus-node-exporter-fips 1.10.2-r3, prometheus-node-exporter-fips 1.7.0-r2, prometheus-node-exporter-fips 1.8.2-r2, prometheus-node-exporter-fips 1.9.1-r1, runc 1.1.14-r0, skaffold 2.16.1-r1, trivy-fips 0.67.2-r0, velero 1.17.0-r0

GHSA-cgrx-mc8f-2prm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QQ16629 Security fix for CVE-2020-16248 applied in: prometheus-blackbox-exporter 0.18.0-r0

Security vulnerability affects the prometheus-blackbox-exporter package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2025-FI25096 Security fix for GHSA-fhg8-qxh5-7q3w applied in: prometheus-nats-exporter 0.15.0-r0, prometheus-nats-exporter 0.16.0-r0

GHSA-fhg8-qxh5-7q3w affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BO10276 Security fix for CVE-2024-35255 applied in: cortex-fips 1.17.2-r1, prometheus 2.47.2-r0, prometheus-operator 0.69.1-r0, stargate 1.0.90-r4

CVE-2024-35255 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...