Executive brief
Prometheus, a popular monitoring and alerting tool, contains a security flaw in its older web interface. An attacker can send malicious data to the system that, when viewed by a user, executes unauthorized code in their web browser. This could allow an attacker to steal sensitive configuration data, delete monitoring records, or shut down the monitoring service entirely.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Prometheus legacy web UI (enabled via --enable-feature=old-ui). The histogram heatmap chart view fails to properly escape 'le' label values before inserting them into the HTML as axis tick mark labels. An attacker can exploit this by injecting malicious metrics through compromised scrape targets, remote write, or OTLP receiver endpoints. When a user views the poisoned metric in the heatmap UI, the injected JavaScript executes in their browser context, potentially allowing the attacker to exfiltrate data, delete series via the admin API, or trigger a service shutdown if lifecycle management is enabled. The issue is fixed in version 0.311.3.
Affected products
- Prometheus Prometheus < 0.311.3
Timeline
- 2026-04-27: disclosed
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-26: other: NVD published