Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| prometheus | prometheus | unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Prometheus | Prometheus |
|
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.201% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-201 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend. | |
| Title | Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects | |
| First Time appeared |
Prometheus
Prometheus prometheus |
|
| Weaknesses | CWE-522 | |
| CPEs | cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Prometheus
Prometheus prometheus |
|
| References |
|
|
| Metrics |
cvssV3_1
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Nov 3, 2026, 2:15 AM