prometheus vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20222
3. 20231
4. 20265

Newest CVEs

• CVE-2026-119566

  Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects

  prometheus · prometheus

  Medium6.3
• CVE-2026-44903

  Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI

  prometheus · prometheus

  Medium5.1
• CVE-2026-42154

  Prometheus: remote read endpoint allows denial of service via crafted snappy payload

  prometheus · prometheus

  High7.5
• CVE-2026-42151

  Prometheus Azure AD remote write OAuth client secret exposed via config API

  prometheus · prometheus

  High7.5
• CVE-2026-40179

  Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

  prometheus · prometheus

  Medium5.3
• CVE-2023-40577

  Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

  prometheus · alertmanager

  High7.5
• CVE-2022-46146

  Prometheus Exporter Toolkit vulnerable to basic authentication bypass

  prometheus · exporter-toolkit

  Medium6.2
• CVE-2022-21698

  Uncontrolled Resource Consumption in promhttp

  prometheus · client_golang

  High7.5
• CVE-2021-29622

  Arbitrary redirects under /new endpoint

  prometheus · prometheus

  Medium6.5