{"id":"CVE-2026-119566","kind":"vulnerability","aliases":["CVE-2026-119566"],"related":[],"title":"Prometheus: remote_write redirects leak Azure AD and Google IAM bearer tokens","description":"Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.","summary":"Prometheus through 3.15.1 forwards its bearer token to whatever host a remote_write request is redirected to. An attacker who controls the remote-write endpoint or a redirecting server can return a 3xx response and capture the Azure AD or Google IAM token.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure-ad","google-iam","prometheus","remote-write","runtime","self-hosted"],"not_affected_if":["no-azure-or-gcp-iam-auth","no-remote-write","trusted-endpoints-only"],"how_to_check":"- Check the Prometheus version with `prometheus --version` and compare it with the fixed release.\n- Look for `remote_write` blocks in the Prometheus config that use Azure AD or Google IAM authentication.\n- Confirm whether remote_write endpoints are reached through hosts you do not control.","fix":null,"status":"open","published_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:39+00:00","updated_at":"2026-10-30T12:32:39+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:32:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Prometheus: remote_write redirects leak Azure AD and Google IAM bearer tokens","impact":"high","summary":"Prometheus through 3.15.1 forwards its bearer token to whatever host a remote_write request is redirected to. An attacker who controls the remote-write endpoint or a redirecting server can return a 3xx response and capture the Azure AD or Google IAM token.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["prometheus","remote-write","azure-ad","google-iam","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"bearer tokens for cloud identity are captured and replayed","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry lists no fix range in the sources provided.","how_to_check":"- Check the Prometheus version with `prometheus --version` and compare it with the fixed release.\n- Look for `remote_write` blocks in the Prometheus config that use Azure AD or Google IAM authentication.\n- Confirm whether remote_write endpoints are reached through hosts you do not control.","plain_action":"","needs_analyst":true,"not_affected_if":["no-remote-write","no-azure-or-gcp-iam-auth","trusted-endpoints-only"],"who_is_affected":"Teams running Prometheus up to and including 3.15.1 that send metrics with remote_write using Azure AD or Google IAM bearer tokens. The risk depends on the remote-write endpoint or a host on its path being attacker-controlled or redirecting; Prometheus setups that only write to fixed, trusted backends on their own network are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4149,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119566':15A,18A '-2026':14A,17A '3.15.1':35B,79C '3xx':66B,119C 'ad':7A,21B,72B,91C 'allow':86C 'anoth':103C 'attack':51B,87C,105C 'azur':6A,20B,71B,90C 'azure-ad':19B 'backend':136C 'bearer':11A,38B,95C 'captur':69B,89C 'contain':80C 'control':53B,106C 'credenti':82C 'cve':13A,16A 'endpoint':58B,111C 'exampl':128C 'forward':36B 'googl':9A,23B,74B,93C 'google-iam':22B 'host':32B,42B,104C,122C 'iam':10A,24B,75B,94C 'leak':5A,83C 'metric':131C 'prometheus':1A,25B,33B,77C 'redirect':4A,48B,61B,98C,114C 'remot':2A,27B,44B,56B,99C,109C 'remote-writ':26B,55B,108C 'replay':124C 'request':46B,101C 'respons':67B 'return':64B,117C 'runtim':29B 'self':31B 'self-host':30B 'server':62B,115C 'token':12A,39B,76B,96C,126C 'victim':134C 'vulner':84C 'whatev':41B 'write':3A,28B,45B,57B,100C,110C,130C","nicknames":[],"mitigations":[],"who_affected":"Teams running Prometheus up to and including 3.15.1 that send metrics with remote_write using Azure AD or Google IAM bearer tokens. The risk depends on the remote-write endpoint or a host on its path being attacker-controlled or redirecting; Prometheus setups that only write to fixed, trusted backends on their own network are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119566","severity":null,"published_at":"2026-10-30T12:16:44+00:00","modified_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}