# CVE-2026-44903: Prometheus stored XSS in legacy web UI heatmap chart

Source: https://junglewise.ai/threats/cve-2026-44903-prometheus-stored-xss-in-legacy-web-ui-heatmap-chart  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44903 · Severity: medium · CVSS 6.1 · Published 2026-05-26

Prometheus, a popular monitoring and alerting tool, contains a security flaw in its older web interface. An attacker can send malicious data to the system that, when viewed by a user, executes unauthorized code in their web browser. This could allow an attacker to steal sensitive configuration data, delete monitoring records, or shut down the monitoring service entirely.

Technologies: [github.com/prometheus/prometheus (Go)](https://junglewise.ai/threats/technologies/github-com-prometheus-prometheus), [Prometheus](https://junglewise.ai/threats/technologies/prometheus). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Prometheus](https://junglewise.ai/threats/vendors/prometheus).

## Quick answers

**Is CVE-2026-44903 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44903 being exploited in the wild.

**How severe is CVE-2026-44903?** Medium severity, with a CVSS score of 6.1, published 26 May 2026.

**Which products and versions are affected?** github.com/prometheus/prometheus (Go) < 0.311.3, SEMVER:introduced=0,fixed=0.311.3; Prometheus < 0.311.3, >= 2.49.0, < 3.5.3; >= 3.11.0, < 3.11.3.

**Is there a fix for CVE-2026-44903?** Yes. github.com/prometheus/prometheus (Go): upgrade to 0.311.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44903 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44903?** Check whether you run github.com/prometheus/prometheus (Go) or Prometheus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/prometheus/prometheus (Go): upgrade to 0.311.3 or later

  ```sh
  go get github.com/prometheus/prometheus@v0.311.3
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Prometheus legacy web UI (enabled via --enable-feature=old-ui). The histogram heatmap chart view fails to properly escape 'le' label values before inserting them into the HTML as axis tick mark labels. An attacker can exploit this by injecting malicious metrics through compromised scrape targets, remote write, or OTLP receiver endpoints. When a user views the poisoned metric in the heatmap UI, the injected JavaScript executes in their browser context, potentially allowing the attacker to exfiltrate data, delete series via the admin API, or trigger a service shutdown if lifecycle management is enabled. The issue is fixed in version 0.311.3.

## Affected products

- Prometheus Prometheus < 0.311.3

## Identifiers

- CVE-2026-44903
- GHSA-fw8g-cg8f-9j28
- GO-2026-5381

## Timeline

- 2026-04-27: disclosed
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-26: other: NVD published

## References

- [https://api.github.com/users/iiihaiii](https://api.github.com/users/iiihaiii)
- [https://github.com/iiihaiii](https://github.com/iiihaiii)
- [https://api.github.com/users/iiihaiii/gists%7B/gist_id%7D](https://api.github.com/users/iiihaiii/gists%7B/gist_id%7D)
- [https://api.github.com/users/iiihaiii/repos](https://api.github.com/users/iiihaiii/repos)
- [https://avatars.githubusercontent.com/u/171326238?v=4](https://avatars.githubusercontent.com/u/171326238?v=4)
- [https://api.github.com/users/iiihaiii/events%7B/privacy%7D](https://api.github.com/users/iiihaiii/events%7B/privacy%7D)

## Related threats

- [Prometheus remote_write credential leak via cross-host redirects](https://junglewise.ai/threats/cve-2026-119566-prometheus-through-3-15-1-contains-a-credential-leak)
- [Prometheus denial of service via memory exhaustion in remote read endpoint](https://junglewise.ai/threats/cve-2026-42154-prometheus-denial-of-service-via-memory-exhaustion-in-remote-read)
- [Prometheus information disclosure in Azure AD OAuth configuration](https://junglewise.ai/threats/cve-2026-42151-prometheus-information-disclosure-in-azure-ad-oauth-configuration)
- [Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer](https://junglewise.ai/threats/cve-2026-40179-prometheus-has-stored-xss-via-metric-names-and-label-values-in)
- [Withdrawn Advisory: Prometheus XSS Vulnerability](https://junglewise.ai/threats/cve-2019-3826-withdrawn-advisory-prometheus-xss-vulnerability)