CVE-2026-40179 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

CVE-2026-40179

CVE-2026-40179 is a stored XSS in Prometheus web UI. Versions 3.0–3.5.1 and 3.6.0–3.11.1 allow metric names/label values to be injected into innerHTML without escaping, affecting Mantine UI and the old React UI. Attackers who can influence metrics (via compromised scrape target, remote write, or ...

CVE-2026-40179 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

CVE-2026-40179

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

CVE-2026-40179

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

CVE-2026-40179

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

CLEANSTART-2026-PM81907 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Multiple security vulnerabilities affect the prometheus package. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

Prometheus 安全漏洞

Prometheus is an open-source software developed in the Go language, used to create real-time metric databases built using the HTTP pull model. Versions 3.0 to 3.5.1 and 3.6.0 to 3.11.1 of Prometheus contain security vulnerabilities. These vulnerabilities stem from a storage-side cross-site...

CLEANSTART-2026-WA14162 Delete function fails to properly validate offsets when processing malformed JSON input

Multiple security vulnerabilities affect the prometheus package. The Delete function fails to properly validate offsets when processing malformed JSON input. See references for individual vulnerability details...

GHSA-VFFH-X6R8-XX99 Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact Stored cross-site scripting XSS via crafted metric names in the Prometheus web UI: Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script...

PT-2026-32579

Name of the Vulnerable Software and Affected Versions Prometheus versions 3.0 through 3.5.1 Prometheus versions 3.6.0 through 3.11.1 Description Stored cross-site scripting exists in multiple components of the Prometheus web UI, specifically within the Mantine UI and the old React UI. The issue...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: eksctl, cert-manager-csi-driver, delve, sftpgo-plugin-pubsub, cis-operator, flux-image-reflector-controller, scorecard, crossplane, external-secrets-operator, witness, policy-controller, knative-operator, crossplane-provider-azure-storage, grafana-pyroscope,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: manifest-tool, sftpgo-plugin-pubsub, yunikorn-web, crossplane-provider-azure-storage, grafana-pyroscope, terraform-provider-aws, kyverno-policy-reporter-ui, k8ssandra-client, falco-no-driver, cloud-provider-azure, authservice, coredns, kyverno, knative-client,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: manifest-tool, sftpgo-plugin-pubsub, yunikorn-web, crossplane-provider-azure-storage, grafana-pyroscope, sbom-convert, terraform-provider-aws, kyverno-policy-reporter-ui, k8ssandra-client, falco-no-driver, cloud-provider-azure, authservice, coredns, kyverno,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: manifest-tool, sftpgo-plugin-pubsub, yunikorn-web, crossplane-provider-azure-storage, grafana-pyroscope, terraform-provider-aws, kyverno-policy-reporter-ui, k8ssandra-client, falco-no-driver, cloud-provider-azure, authservice, coredns, kyverno, knative-client,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: eksctl, cert-manager-csi-driver, delve, sftpgo-plugin-pubsub, cis-operator, flux-image-reflector-controller, scorecard, crossplane, external-secrets-operator, witness, policy-controller, knative-operator, crossplane-provider-azure-storage, grafana-pyroscope,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: seaweedfs, teleport-operator-fips, k8ssandra-client, secrets-store-csi-driver-provider-azure-fips, grafana-agent-operator, cloud-provider-aws, rabbitmq-messaging-topology-operator-fips, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-elbv2,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: seaweedfs, k8ssandra-client, cloud-provider-aws, rabbitmq-messaging-topology-operator-fips, gitlab-pages, flux-helm-controller, prometheus-operator, witness, apko-fips, cerbos, gitlab-kas, xeol, crane, spegel, cephcsi, kubernetes-dashboard, dask-gateway,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: seaweedfs, k8ssandra-client, cloud-provider-aws, rabbitmq-messaging-topology-operator-fips, gitlab-pages, flux-helm-controller, prometheus-operator, witness, apko-fips, cerbos, gitlab-kas, xeol, crane, spegel, cephcsi, kubernetes-dashboard, dask-gateway,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: seaweedfs, teleport-operator-fips, k8ssandra-client, secrets-store-csi-driver-provider-azure-fips, grafana-agent-operator, cloud-provider-aws, rabbitmq-messaging-topology-operator-fips, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-elbv2,...