CVE-2026-44903

Prometheus versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 contain stored cross-site scripting vulnerabilities in the web UI where metric names and label values are injected into innerHTML without escaping. Because Prometheus v3.x defaults to UTF-8 validation allowing characters like <, >, and " in metric and label names, an attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver can execute arbitrary JavaScript in the browser of any user viewing the metric in the Graph UI. The issue is fixed in versions 3.5.2 and 3.11.2.

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.

Prometheus before versions 3.5.3 and 3.11.3 does not validate the declared decoded length in a snappy-compressed request to the /api/v1/read endpoint before allocating memory. An unauthenticated attacker can send a small payload causing a huge heap allocation, potentially exhausting memory and crashing the Prometheus process under concurrent load.

Prometheus prior to versions 3.5.3 and 3.11.3 stores the client_secret field in Azure AD OAuth configuration as a plain string instead of a Secret. This exposes the Azure OAuth client secret in plaintext to any user or process with access to the /-/config endpoint.