Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
Not affected - two reasons. 1) The vulnerable code is not present in this package or in its SRPM. CVE-2026-119566 lives in github.com/prometheus/common/config (http_config.go: the bearer / basic-auth / OAuth2 round-trippers forwarded Authorization and Cookie headers on cross-host redirects; fixed upstream in https://github.com/prometheus/common/pull/901) and is reachable only from the Prometheus *server* remote_write client (storage/remote/client.go, storage/remote/azuread/azuread.go). i2c-display imports only github.com/prometheus/client_golang/prometheus and github.com/prometheus/client_golang/prometheus/promhttp, and only to expose its own metrics endpoint server-side (internal/metrics/metrics.go). It has no outbound net/http client, no remote_write support, and no cloud bearer credentials of any kind, so there is no code path that can issue an authenticated request, follow a redirect, and leak a token. The dependency set is packaged per the go2rpm / go-vendor-tools convention: the vendor archive is generated by go_vendor_archive from the Source0 tarball, so vendor/modules.txt in the SRPM is authoritative for what is compiled. That archive contains only prometheus/common/expfmt and prometheus/common/model: $ tar -tjf i2c-display-0.5.6-vendor.tar.bz2 | grep -c 'prometheus/common/config/' 0 $ go list -deps ./cmd/... | grep prometheus/common github.com/prometheus/common/model github.com/prometheus/common/expfmt common/config is neither vendored nor linked. 2) The pinned version already contains the upstream fix. The fix landed in prometheus/common v0.69.0 (PR #901 merged 2026-06-11, released 2026-06-17). Version 0.5.6 in the archive pins v0.71.0, and the upcoming 0.5.7 pins v0.72.1 - both postdate the fix. No dependency update was required for this CVE; the bump to v0.72.1 is routine hygiene. This matches the statement on the flaw bug: exploitation requires a configured remote_write endpoint using cloud provider bearer authentication, which this package never configures or performs. It ships as a systemd service driving an I2C OLED display on a single board computer; when metrics are enabled it only serves a Prometheus text endpoint on the local network. Verified at 0.5.6 and at HEAD with the refreshed vendor tree: go build ./..., go vet ./... and go test ./... all pass. Closing as NOTABUG.