22 matches found
CVE-2026-40179-PoC
CVE-2026-40179 — Prometheus stored XSS via remotewrite A minimal, dependency-light proof of concept for CVE-2026-40179 GHSA-vffh-x6r8-xx99: stored cross-site scripting in the Prometheus web UI, delivered through an unauthenticated remotewrite endpoint. The vulnerability Prometheus 3.x renders...
prometheus-bearer-redirect
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · prometheus-bearer-redirect Write-up: https://abraxaslabs.tech/research/prometheus-bearer-redirect prometheus-bearer-redirect Class: Credential leak Reach: Remote Prometheus v3.15.0 5241a27 - CNCF / Prometheus...
CVE-2026-119566
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and...
Linux Distros Unpatched Vulnerability : CVE-2026-119566
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting...
AZL-112688 CVE-2026-119566 affecting package telegraf 1.31.0-38
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and...
CVE-2026-119566
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and...
DEBIAN-CVE-2026-119566
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and...
CVE-2026-119566
Versions of Prometheus through 3.15.1 are vulnerable to a credential leak via remote_write cross-host redirects . An attacker who controls the remote-write endpoint or a redirecting server can issue a 3xx redirect , causing the system to transmit Azure AD or Google IAM bearer tokens to an externa...
CVE-2026-119566
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and...
CVE-2026-119566 Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and...
EUVD-2026-113831
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and...
CVE-2026-119566 Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and...
CVE-2026-119566: prometheus: Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google…
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and...
Exploit for Cross-site Scripting in Prometheus
CVE-2026-40179 — Prometheus stored XSS via remotewrite A m...
SUSE CVE-2026-26931
Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation CAPEC-130...
Elastic Beats metricbeat 8.0.x < 8.19.13 / 9.0.x < 9.2.5 DoS (ESA-2026-09)
The version of Elastic Beats metricbeat installed on the remote host is 8.0.x prior to 8.19.13, 9.0.x prior to 9.2.5. It is, therefore, affected by a denial of service vulnerability. - Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can...
CVE-2026-26931
Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation CAPEC-130...
CVE-2026-26931 Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service
Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation CAPEC-130...
CVE-2026-26931 Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service
Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation CAPEC-130...