CVE-2026-40179
2 advisories.
Go/github.com/prometheus/prometheus CVE-2026-40179: medium 6.1
Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer
Action: Upgrade github.com/prometheus/prometheus to 0.311.2-0.20260410083055-07c6232d159b or later.
go get github.com/prometheus/prometheus@v3.5.2go get github.com/prometheus/prometheus@v3.11.2go get github.com/prometheus/prometheus@v0.311.2-0.20260410083055-07c6232d159bAffected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.5.2 | - |
| 3.6.0 | 3.11.2 | - |
| 0 | 0.311.2-0.20260410083055-07c6232d159b | - |
Fixed versions
| 3.5.2 | 3.11.2 | 0.311.2-0.20260410083055-07c6232d159b |
Sources
- osv: GHSA-vffh-x6r8-xx99
- https://github.com/prometheus/prometheus/security/advisories/GHSA-vffh-x6r8-xx99
- https://nvd.nist.gov/vuln/detail/CVE-2026-40179
- https://github.com/prometheus/prometheus/pull/18506
- https://github.com/prometheus/prometheus/commit/07c6232d159bfb474a077788be184d87adcfac3c
- https://github.com/prometheus/prometheus
CVE-2026-40179 · published · modified · JSON
Go/github.com/prometheus/prometheus CVE-2026-40179: unknown
Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus
Action: Upgrade github.com/prometheus/prometheus to 0.311.2-0.20260410083055-07c6232d159b or later.
go get github.com/prometheus/prometheus@v0.311.2-0.20260410083055-07c6232d159bAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.311.2-0.20260410083055-07c6232d159b | - |
Fixed versions
| 0.311.2-0.20260410083055-07c6232d159b |
Sources
- osv: GO-2026-5662
- https://github.com/prometheus/prometheus/security/advisories/GHSA-vffh-x6r8-xx99
- https://github.com/prometheus/prometheus/commit/07c6232d159bfb474a077788be184d87adcfac3c
- https://github.com/prometheus/prometheus/pull/18506
CVE-2026-40179 · published · modified · JSON