Bug 2563959 (CVE-2026-119566)

Summary: CVE-2026-119566 github.com/prometheus/common: Prometheus: Information disclosure via HTTP redirects in remote write requests
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abarbaro, abrianik, akhatavk, akostadi, akoudelk, alebedev, alizardo, amasferr, amctagga, anjoseph, anpicker, ansmith, anthomas, aoconnor, aos-team-art-private, aprice, asdas, asegurap, asyoung, blitton, bmuthuka, bniver, bsquizza, cahl, chfoley, ckandaga, cmah, cmitchel, cmyers, crizzo, dakwon, dbosanac, dfreiber, dhanak, dkeler, dmayorov, dnakabaa, doconnor, dpaolell, drosa, drow, dschmidt, dsimansk, dymurray, eaguilar, ebaron, eborisov, efried, eglynn, ehelms, elicohen, flucifre, gbenhaim, ggainey, ggrzybek, gmeno, gparvin, groman, gtanzill, hasun, hoberger, ibolton, jbalunas, jbritton, jburrell, jbuscemi, jcantril, jchui, jdelft, jdobes, jeder, jfula, jhe, jhollowa, jjoyce, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jprabhak, jpretori, jraez, jreimann, jsamir, jschluet, jsherril, jtolenti, jturenov, jupierce, juwatts, kaycoth, kbempah, kgaikwad, kingland, kshier, ktsao, lball, lberk, lbragsta, lchilton, lcouzens, lgamliel, lgarciaa, lhh, ljawale, lpele, mbarnett, mbenjamin, mbiarnes, mburns, mdellweg, mdessi, mgarciac, mhackett, mhulan, mkleinhe, mnovotny, mold, mrizzi, mrunge, msilmser, mszuc, mwringe, nboldt, ngough, niyer, nmoumoul, nyancey, oaljalju, oezr, ometelka, orabin, osousa, pakotvan, pantinor, parichar, pcattana, pcreech, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, prichard, psrna, ptisnovs, pvasanth, pwambui, rbobbitt, rchan, rekumar, rhaigner, rhel-process-autobot, rjohnson, rochandr, rojacob, sakbas, sarad, sausingh, sbratsla, sdawley, sfeifer, sghai, sidsharm, simaishi, slakshmi, slucidi, smallamp, solenoci, sostapov, sprizend, sseago, stcannon, sthirugn, sumehta, suppawar, swoodman, syedriko, tasato, thason, tmalecek, tsedmik, tsze, twaugh, tzivkovi, vereddy, veshanka, vimartin, vkarehfa, vkumar, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, wscales, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Prometheus. This vulnerability allows an attacker who controls a configured remote write endpoint or redirecting server to cause an information disclosure. By returning an HTTP redirect response to an arbitrary host, the server can induce Prometheus into forwarding sensitive authentication bearer tokens used for cloud services. An attacker can capture and replay these leaked credentials to perform unauthorized actions against target backend systems.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2564736, 2564737, 2564738, 2564739, 2564740, 2564741, 2564742, 2564743, 2564744, 2564745, 2564746, 2564747, 2564748, 2564749, 2564750, 2564752, 2564753, 2564754, 2564755, 2564756, 2564757, 2564758, 2564759, 2564760, 2564761, 2564762, 2564763, 2564764, 2564765, 2564766, 2564767, 2564768, 2564769, 2564770, 2564771, 2564772, 2564773, 2564775, 2564776, 2564778, 2564780, 2564785, 2564789, 2564791, 2564793, 2564797, 2564799, 2564806, 2564810, 2564814, 2564817, 2564820, 2564823, 2564826, 2564832, 2564834, 2564837, 2564841, 2564846, 2564849, 2564853, 2564855, 2564858, 2564861, 2564864, 2564867, 2564869, 2564872, 2564875, 2564878, 2564880, 2564883, 2564885, 2564890, 2564892, 2564895, 2564898, 2564899, 2564900, 2564901, 2564903, 2564904, 2564905, 2564906, 2564907, 2564908, 2564909, 2564910, 2564911, 2564912, 2564913, 2564914, 2564917, 2564918, 2564919, 2564921, 2564922, 2564923, 2564924, 2564926, 2564927, 2564928, 2564929, 2564930, 2564931, 2564932, 2564935, 2564938, 2564940, 2564942, 2564946, 2564947, 2564949, 2564950, 2564952, 2564953, 2564954, 2564956, 2564957, 2564958, 2564959, 2564960, 2564961, 2564962, 2564963, 2564964, 2564965, 2564966, 2564967, 2564968, 2564975, 2564988, 2565005, 2565025, 2565043, 2565058, 2565064, 2565077, 2565079, 2565081, 2565082, 2565098, 2565104, 2565105, 2565106, 2565107, 2565108, 2565109, 2565110, 2565111, 2565112, 2565113, 2565114, 2564803, 2564830, 2564844, 2564915, 2564916, 2564920, 2564925, 2564933, 2564971, 2564979, 2564997, 2565013, 2565033, 2565049, 2565070, 2565078, 2565080, 2565083, 2565084, 2565085, 2565086, 2565087, 2565088, 2565089, 2565090, 2565091, 2565092, 2565093, 2565094, 2565097, 2565099, 2565101, 2565102, 2565103    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-30 12:22:03 UTC 
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.