Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

prometheus-node-exporter may expose system data via protojson

published 6 months ago
Summary

The Prometheus node exporter, a tool that gathers server statistics, has several weaknesses in the part of the program that formats data called protojson. These weaknesses could allow an attacker to read or modify the information the exporter shares, revealing internal details of your machines. Install the newest version of the exporter to close the gaps.

What to do
  • Update cleanstart prometheus-node-exporter to version 1.8.0-r3.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart prometheus-node-exporter < 1.8.0-r3
Fix: upgrade to 1.8.0-r3
Original advisory text
protojson
Multiple security vulnerabilities affect the prometheus-node-exporter package. The protojson. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published11 Apr 2026
Updated9 Sep 2026
First seen9 Sep 2026
Sources
CLEANSTART-2026-JT73156 · OSV
Track software like this
Free during beta