Is CVE-2026-119566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119566 being exploited in the wild.

How severe is CVE-2026-119566?

Medium severity, with a CVSS score of 4.8, published 30 October 2026.

Is there a fix for CVE-2026-119566?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119566 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-119566?

Check whether you run Prometheus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119566: Prometheus remote_write credential leak via cross-host redirects

CVE-2026-119566 · Severity: medium · CVSS 4.8 · Published 2026-10-30

Prometheus, an open-source monitoring and metrics collection system, leaks Azure AD and Google IAM authentication bearer tokens when remote_write requests are redirected to attacker-controlled servers. An attacker who controls the remote-write endpoint or a redirecting intermediary can capture live credentials and use them to write metrics to or access the victim's cloud monitoring backend, potentially leading to data manipulation or unauthorized access.

Technologies: Prometheus. Vendors: Prometheus.

Quick answers

Is CVE-2026-119566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119566 being exploited in the wild.
How severe is CVE-2026-119566?: Medium severity, with a CVSS score of 4.8, published 30 October 2026.
Which products and versions are affected?: Prometheus through 3.15.1.
Is there a fix for CVE-2026-119566?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119566 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-119566?: Check whether you run Prometheus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists because Azure AD and Google IAM authentication wrappers in Prometheus's remote_write client re-add the Authorization header on every hop during HTTP redirects, bypassing the credential-stripping logic introduced in prometheus/common v0.69.0. When follow_redirects is true (the default), a 3xx redirect response from the remote_write URL to an attacker-controlled host will forward the bearer token. This affects only configurations that explicitly set remote_write with azuread or google_iam authentication.

Affected products

Prometheus Prometheus through 3.15.1

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.