Live › vulnerability › CVE-2026-119566
Prometheus through 3.15.1 forwards its bearer token to whatever host a remote_write request is redirected to. An attacker who controls the remote-write endpoint or a redirecting server can return a 3xx response and capture the Azure AD or Google IAM token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams running Prometheus up to and including 3.15.1 that send metrics with remote_write using Azure AD or Google IAM bearer tokens. The risk depends on the remote-write endpoint or a host on its path being attacker-controlled or redirecting; Prometheus setups that only write to fixed, trusted backends on their own network are less exposed.
No product ranges from the sources yet.
prometheus --version and compare it with the fixed release.remote_write blocks in the Prometheus config that use Azure AD or Google IAM authentication.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
This page as .md · .json · in your agent: get_signal("CVE-2026-119566")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.