Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2026-44903: Prometheus Legacy Web UI Allows Malicious Code Execution
CVE-2026-44903 · published 5 months ago
Summary
The legacy web interface in Prometheus, an open-source monitoring system, is vulnerable to code injection attacks. This means an attacker can trick users into viewing malicious data, allowing the attacker to execute code on the user's browser. To fix this issue, update Prometheus to version 3.5.3 or 3.11.3 or later.
What to do
- Update prometheus to version 3.11.3.
- Update prometheus rootio-github.com/prometheus/prometheus to version v0.308.1-root.io.1.
- Update prometheus rootio-github.com/prometheus/prometheus to version v0.308.1-root.io.3.
- Update prometheus github.com/prometheus/prometheus to version v0.308.1-aikido.3.
- Update github.com prometheus to version 0.311.3.
- Update prometheus github.com/prometheus/prometheus to version 0.311.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | prometheus |
>= 3.6.0, < 3.11.3 Fix: upgrade to 3.11.3
|
| Debian:13 | debian | prometheus | All versions |
| Debian:14 | debian | prometheus | All versions |
| – | prometheus | prometheus |
>= 2.49.0, < 3.5.3 >= 3.6.0, < 3.11.3 cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | prometheus | All versions |
| Ubuntu:18.04:LTS | canonical | prometheus | All versions |
| Ubuntu:20.04:LTS | canonical | prometheus | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | prometheus | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | prometheus | All versions |
| Ubuntu:25.10 | canonical | prometheus | All versions |
| Ubuntu:26.04:LTS | canonical | prometheus | All versions |
| Root:Go | prometheus | rootio-github.com/prometheus/prometheus |
< v0.308.1-root.io.1 < v0.308.1-root.io.3 Fix: upgrade to v0.308.1-root.io.1
|
| Root:Go | prometheus | github.com/prometheus/prometheus |
< v0.308.1-aikido.3 Fix: upgrade to v0.308.1-aikido.3
|
| go | github.com | prometheus |
< 0.311.3 Fix: upgrade to 0.311.3
|
| Go | prometheus | github.com/prometheus/prometheus |
< 0.311.3 Fix: upgrade to 0.311.3
|
Original advisory text
Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable...
Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.
References
- https://github.com/advisories/GHSA-fw8g-cg8f-9j28
- https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44903 URL
- https://security-tracker.debian.org/tracker/CVE-2026-44903 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-44903 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-44903 Third Party Advisory
- https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb... Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published26 May 2026
Updated29 Oct 2026
First seen26 May 2026
Sources
DEBIAN-CVE-2026-44903 · OSV
UBUNTU-CVE-2026-44903 · OSV
CVE-2026-44903 · NVD
GO-2026-5381 · OSV
Track software like this
Free during beta