Stored Cross-Site Scripting Vulnerability in Prometheus Monitoring System
CVE-2026-40179
What is CVE-2026-40179?
Prometheus, an open-source monitoring system and time series database, is subject to stored cross-site scripting vulnerabilities within its web UI. Specifically, in versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1, metric names and label values are inadequately handled, allowing HTML and JavaScript content to be injected into the interface without proper sanitization. This flaw is present in both the Mantine UI and the older React UI, particularly affecting chart tooltips and metric search functionalities. If an attacker can compromise metrics through a malicious scrape target, remote write, or OTLP receiver, they could execute arbitrary JavaScript in the browsers of users viewing affected metrics, leading to potential configuration exfiltration and manipulation. Users are advised to upgrade to versions 3.5.2 or 3.11.2 to mitigate risks and implement recommended security practices to safeguard their environments.
Affected Version(s)
prometheus >= 3.0.0, < 3.5.2 < 3.0.0, 3.5.2
prometheus >= 3.6.0, < 3.11.2 < 3.6.0, 3.11.2
prometheus < 0.311.2-0.20260410083055-07c6232d159b < 0.311.2-0.20260410083055-07c6232d159b