CVE-2026-40179 in Prometheus
Summary
by MITRE • 04/16/2026
Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like , and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability CVE-2026-40179 represents a critical stored cross-site scripting flaw in the Prometheus monitoring system affecting versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1. This security issue stems from insufficient input sanitization within the web user interface components where metric names and label values are directly injected into the DOM using innerHTML or dangerouslySetInnerHTML methods without proper HTML escaping. The vulnerability manifests across multiple UI components including chart tooltips on the Graph page, Metric Explorer fuzzy search results, and heatmap cell tooltips, creating multiple attack vectors for malicious code execution. The flaw is particularly concerning as it leverages the default UTF-8 validation introduced in Prometheus v3.x which now permits characters such as commas and quotation marks in metric names and labels, expanding the potential attack surface for malicious injection.
The technical exploitation of this vulnerability occurs when an attacker successfully injects malicious metrics through compromised scrape targets, remote write endpoints, or OTLP receiver interfaces. When legitimate users view these poisoned metrics in the Prometheus Graph UI, the browser executes the injected JavaScript code, potentially leading to severe consequences including configuration exfiltration, unauthorized data deletion, or complete system shutdown depending on the enabled administrative flags. This type of vulnerability aligns with CWE-79 (Cross-site Scripting) and represents a classic stored XSS attack pattern where malicious input is permanently stored and later executed in the context of other users' browsers. The attack vector is particularly insidious because it requires minimal user interaction beyond viewing the affected metrics, making it difficult to detect and prevent through traditional user awareness measures.
The operational impact of this vulnerability extends beyond simple code execution as it fundamentally compromises the integrity and confidentiality of monitoring data within Prometheus environments. Organizations relying on Prometheus for infrastructure monitoring face potential data breaches, system compromise, and operational disruption when attackers leverage this vulnerability to gain unauthorized access to monitoring systems. The attack requires only that malicious metrics be injected into the system through legitimate ingestion points, making it particularly dangerous in environments where multiple third-party services contribute metrics or where security controls around data ingestion are insufficient. The vulnerability's persistence in the system means that once exploited, the malicious code can continue executing whenever affected users access the monitoring interface, potentially providing attackers with extended access to the environment.
Mitigation strategies for this vulnerability focus on both immediate defensive measures and long-term architectural improvements. The primary solution involves upgrading to patched versions 3.5.2 and 3.11.2 where proper input sanitization has been implemented. Until such upgrades are possible, administrators should implement network-level controls to ensure that remote write receivers and OTLP receivers are not exposed to untrusted networks or sources, effectively blocking potential injection points. Additionally, organizations must rigorously validate all scrape targets and ensure they are from trusted sources, implementing strict access controls and monitoring for unauthorized metric injection attempts. Security configurations should avoid enabling administrative APIs in environments where untrusted data might be ingested, and users should be trained to avoid clicking suspicious links or using functions like label_replace that could generate poisoned label values. This vulnerability demonstrates the importance of input validation in web applications and aligns with ATT&CK technique T1211 (Exploitation for Privilege Escalation) and T1566 (Phishing) when considering the potential for lateral movement and initial access through compromised monitoring systems.