Is CVE-2026-44903 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44903 being exploited in the wild.

How severe is CVE-2026-44903?

Medium severity, with a CVSS score of 6.1, published 26 May 2026.

Which products and versions are affected?

github.com/prometheus/prometheus (Go) = 2.49.0, = 3.11.0, < 3.11.3.

Is there a fix for CVE-2026-44903?

Yes. github.com/prometheus/prometheus (Go): upgrade to 0.311.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44903 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44903?

Check whether you run github.com/prometheus/prometheus (Go) or Prometheus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44903: Prometheus stored XSS in legacy web UI heatmap chart

Q: Is there a fix for CVE-2026-44903?

Yes. github.com/prometheus/prometheus (Go): upgrade to 0.311.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44903 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-44903?

Check whether you run github.com/prometheus/prometheus (Go) or Prometheus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44903 · Severity: medium · CVSS 6.1 · Published 2026-05-26

Prometheus, a popular monitoring and alerting tool, contains a security flaw in its older web interface. An attacker can send malicious data to the system that, when viewed by a user, executes unauthorized code in their web browser. This could allow an attacker to steal sensitive configuration data, delete monitoring records, or shut down the monitoring service entirely.

Technologies: github.com/prometheus/prometheus (Go), Prometheus. Vendors: Go, Prometheus.

Quick answers

Is CVE-2026-44903 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44903 being exploited in the wild.
How severe is CVE-2026-44903?: Medium severity, with a CVSS score of 6.1, published 26 May 2026.
Which products and versions are affected?: github.com/prometheus/prometheus (Go) < 0.311.3, SEMVER:introduced=0,fixed=0.311.3; Prometheus < 0.311.3, >= 2.49.0, < 3.5.3; >= 3.11.0, < 3.11.3.
Is there a fix for CVE-2026-44903?: Yes. github.com/prometheus/prometheus (Go): upgrade to 0.311.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44903 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44903?: Check whether you run github.com/prometheus/prometheus (Go) or Prometheus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/prometheus/prometheus (Go): upgrade to 0.311.3 or later
```
go get github.com/prometheus/prometheus@v0.311.3
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Prometheus legacy web UI (enabled via --enable-feature=old-ui). The histogram heatmap chart view fails to properly escape 'le' label values before inserting them into the HTML as axis tick mark labels. An attacker can exploit this by injecting malicious metrics through compromised scrape targets, remote write, or OTLP receiver endpoints. When a user views the poisoned metric in the heatmap UI, the injected JavaScript executes in their browser context, potentially allowing the attacker to exfiltrate data, delete series via the admin API, or trigger a service shutdown if lifecycle management is enabled. The issue is fixed in version 0.311.3.

Affected products

Prometheus Prometheus < 0.311.3

Identifiers

CVE-2026-44903
GHSA-fw8g-cg8f-9j28
GO-2026-5381

Timeline

2026-04-27: disclosed
2026-05-05: advisory: GitHub Advisory published
2026-05-26: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.