{"action":"Upgrade github.com/prometheus/prometheus/v2 to 2.37.4 or later.","affected":[{"fixed":"2.37.4","introduced":"2.24.1"},{"fixed":"2.40.4","introduced":"2.38.0"}],"component":"github.com/prometheus/prometheus/v2","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["2.37.4","2.40.4"],"ghsa_id":"GHSA-4v48-4q5m-8vx4","id":"tcs_01M5KEX4SZS218SKR04A9845M9","modified_at":"2026-04-15T21:19:00.736054Z","published_at":"2022-12-05T22:01:08Z","references":["https://osv.dev/vulnerability/GHSA-4v48-4q5m-8vx4","https://github.com/prometheus/prometheus/security/advisories/GHSA-4v48-4q5m-8vx4","https://github.com/prometheus/prometheus/commit/31a2db3ae9c0f4b486b6895973beabc1d1beac93","https://github.com/prometheus/prometheus/releases/tag/v2.37.4","https://github.com/prometheus/prometheus/releases/tag/v2.40.4"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-4v48-4q5m-8vx4#Go/github.com/prometheus/prometheus/v2","url":"https://osv.dev/vulnerability/GHSA-4v48-4q5m-8vx4"}],"summary":"Prometheus vulnerable to basic authentication bypass"}