Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and
    3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the
    Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In
    both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing
    HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use
    dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without
    sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like
    <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised
    scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of
    any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration,
    data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions
    3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are
    recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP
    receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets
    are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g.,
    --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested;
    and refrain from clicking untrusted links, particularly those containing functions such as label_replace,
    as they may generate poisoned label names and values. (CVE-2026-40179)

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread)
    was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the
    configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth
    client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has
    been patched in versions 3.5.3 and 3.11.3. (CVE-2026-42151)

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-
    compressed request body before allocating memory. An unauthenticated attacker can send a small payload
    that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory
    and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and
    3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the
    Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In
    both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing
    HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use
    dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without
    sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like
    <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised
    scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of
    any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration,
    data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions
    3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are
    recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP
    receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets
    are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g.,
    --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested;
    and refrain from clicking untrusted links, particularly those containing functions such as label_replace,
    as they may generate poisoned label names and values. (CVE-2026-40179)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and     3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the     Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In     both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing     HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use     dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without     sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like     <, >, and  are now valid in metric names and labels. An attacker who can inject metrics via a compromised     scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of     any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration,     data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions     3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are     recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP     receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets     are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g.,
    --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested;
    and refrain from clicking untrusted links, particularly those containing functions such as label_replace,     as they may generate poisoned label names and values. (CVE-2026-40179)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
441027	Alpine: multiple prometheus packages: security update to 3.5.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
441027	Alpine: multiple prometheus packages: security update to 3.5.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
440929	SCA: security update for github.com/prometheus/prometheus (GHSA-vffh-x6r8-xx99)	Tenable Cloud Security	SCA Checks	medium
440929	SCA: security update for github.com/prometheus/prometheus (GHSA-vffh-x6r8-xx99)	Tenable Self-Hosted Container Security	SCA Checks	medium
307590	Linux Distros Unpatched Vulnerability : CVE-2026-40179	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-40179

medium

Tenable Plugins

medium

medium

medium

medium

medium