Arbitrary redirects under /new endpoint

Description

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

Scores

EPSS (exploitation in 30 days)

19.6% · top 2.6% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (opens in a new tab)All about CWE-601 and its CVEs

Affected products

• prometheus · prometheus

  • affected >= 2.23.0, < 2.27.1

References (3)

• https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/prometheus/prometheus/releases/tag/v2.26.1 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/prometheus/prometheus/releases/tag/v2.27.1 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2021-29622](https://trackcve.app/badge/CVE-2021-29622.svg)](https://trackcve.app/cve/CVE-2021-29622)

Record last updated 3 Aug 2024, 22:11 UTC.