Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

Prometheus allows token theft via remote_write redirects

CVE-2026-119566 · published 5 days ago
Summary

The Prometheus monitoring system (up to version 3.15.1) can leak authentication tokens when its remote_write feature is tricked into following a redirect to another server. An attacker who controls the destination server can capture Azure AD or Google IAM tokens and use them to send false data or access other services. Update Prometheus to a newer version or disable remote_write redirects to stop the leak.

What to do
  • Update debian golang-github-prometheus-common to version 0.69.0-1.
Affected software
Ecosystem VendorProductAffected versions
– prometheus prometheus <= 3.15.1
Debian:12 debian golang-github-prometheus-common All versions
Debian:14 debian golang-github-prometheus-common < 0.69.0-1
Fix: upgrade to 0.69.0-1
Ubuntu:16.04:LTS canonical golang-github-prometheus-common All versions
Original advisory text
Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published30 Oct 2026
Updated5 Nov 2026
First seen30 Oct 2026
Sources
CVE-2026-119566 · NVD
CVE-2026-119566 · MITRE
CVE-2026-119566 · OSV
DEBIAN-CVE-2026-119566 · OSV
UBUNTU-CVE-2026-119566 · OSV
Track software like this
Free during beta