Go/github.com/prometheus/prometheus CVE-2026-40179: medium 6.1, EPSS 0.31%

Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Action: Upgrade github.com/prometheus/prometheus to 0.311.2-0.20260410083055-07c6232d159b or later.

go get github.com/prometheus/prometheus@v0.311.2-0.20260410083055-07c6232d159b

Affected

Fixed versions

Sources

• osv: GO-2026-5662
• nvd: CVE-2026-40179
• https://github.com/prometheus/prometheus/security/advisories/GHSA-vffh-x6r8-xx99
• https://github.com/prometheus/prometheus/commit/07c6232d159bfb474a077788be184d87adcfac3c
• https://github.com/prometheus/prometheus/pull/18506

CVE-2026-40179 · published 2026-06-25T22:34:38Z · modified 2026-07-15T16:27:28.342369934Z · JSON