Credential Leak Vulnerability in Prometheus by Grafana Labs

CVE-2026-119566

What is CVE-2026-119566?

Prometheus, up to version 3.15.1, has a vulnerability that allows attackers to exploit remote_write requests and capture sensitive Azure AD or Google IAM bearer tokens. By redirecting these requests to a malicious host, attackers can generate a 3xx response and impersonate the victim, enabling them to write unauthorized metrics to the victim's backend. This serious security risk highlights the need for implementing proper validation and security measures to protect against such token replay attacks.

References