Bug 2563959 (CVE-2026-119566) - CVE-2026-119566 github.com/prometheus/common: Prometheus: Information disclosure via HTTP redirects in remote write requests
Summary: CVE-2026-119566 github.com/prometheus/common: Prometheus: Information disclos...
Keywords:
Status: NEW
Alias: CVE-2026-119566
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2564736 2564737 2564738 2564739 2564740 2564741 2564742 2564743 2564744 2564745 2564746 2564747 2564748 2564749 2564750 2564752 2564753 2564754 2564755 2564756 2564757 2564758 2564759 2564760 2564761 2564762 2564763 2564764 2564765 2564766 2564767 2564768 2564769 2564770 2564771 2564772 2564773 2564775 2564776 2564778 2564780 2564785 2564789 2564791 2564793 2564797 2564799 2564806 2564810 2564814 2564817 2564820 2564823 2564826 2564832 2564834 2564837 2564841 2564846 2564849 2564853 2564855 2564858 2564861 2564864 2564867 2564869 2564872 2564875 2564878 2564880 2564883 2564885 2564890 2564892 2564895 2564898 2564899 2564900 2564901 2564903 2564904 2564905 2564906 2564907 2564908 2564909 2564910 2564911 2564912 2564913 2564914 2564917 2564918 2564919 2564921 2564922 2564923 2564924 2564926 2564927 2564928 2564929 2564930 2564931 2564932 2564935 2564938 2564940 2564942 2564946 2564947 2564949 2564950 2564952 2564953 2564954 2564956 2564957 2564958 2564959 2564960 2564961 2564962 2564963 2564964 2564965 2564966 2564967 2564968 2564975 2564988 2565005 2565025 2565043 2565058 2565064 2565077 2565079 2565081 2565082 2565098 2565104 2565105 2565106 2565107 2565108 2565109 2565110 2565111 2565112 2565113 2565114 2564803 2564830 2564844 2564915 2564916 2564920 2564925 2564933 2564971 2564979 2564997 2565013 2565033 2565049 2565070 2565078 2565080 2565083 2565084 2565085 2565086 2565087 2565088 2565089 2565090 2565091 2565092 2565093 2565094 2565097 2565099 2565101 2565102 2565103
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-30 12:22 UTC by OSIDB Bzimport
Modified: 2026-11-03 08:31 UTC (History)
203 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-30 12:22:03 UTC 
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
Note You need to log in before you can comment on or make changes to this bug.