CVE-2026-119566

Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects

Published Oct 30, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
Title Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
First Time appeared Prometheus
Prometheus prometheus
Weaknesses CWE-522
CPEs cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*
Vendors & Products Prometheus
Prometheus prometheus
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 4, 2026, 10:20 PM
Reserved
Oct 30, 2026, 10:53 AM
Status
Awaiting Analysis
Published
Oct 30, 2026, 12:16 PM
Modified
Nov 4, 2026, 11:17 PM
Severity
Moderate
Public date
Oct 30, 2026, 11:31 AM