Prometheus
8 CVEs across 6 Prometheus products. Browse Prometheus vulnerabilities, severities, and proof-of-concept exploits.
Prometheus products with known CVEs
Prometheus CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-44903 | Medium | 6.1 | 2026-05-26 | Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enab… |
CVE-2026-42154 | High | 7.5 | 2026-05-04 | Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not v… |
CVE-2026-42151 | High | 7.5 | 2026-05-04 | Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote wri… |
CVE-2026-40179 | Medium | 6.1 | 2026-04-15 | Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting v… |
CVE-2023-40577 | High | 7.5 | 2023-08-25 | Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/… |
CVE-2023-26735 | High | 7.5 | 2023-04-26 | blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet port… |
CVE-2022-46146 | Medium | 6.2 | 2022-11-29 | Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and… |
CVE-2022-21698 | High | 7.5 | 2022-02-15 | client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers… |
CVE-2021-29622 | Medium | 6.5 | 2021-05-19 | Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless trans… |
CVE-2020-16248 | Medium | 5.8 | 2020-08-09 | Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both in… |
CVE-2019-3826 | Medium | 6.1 | 2019-03-26 | A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticate… |