CLEANSTART-2026-ZW55727: Prometheus is an open-source monitoring system and time series database

Q: Does exploitation require an authenticated account or user action?

No privileges are required, and the attack vector is network-based with low attack complexity. However, user interaction is required for exploitation.

Q: What impact is reported if exploitation succeeds?

The reported impact is low confidentiality and low integrity impact, with no availability impact. The scope is changed, indicating the impact may extend beyond the vulnerable component's original security authority.

Published Nov 5, 2026

Updated

Security vulnerability affects the keda package. Prometheus is an open-source monitoring system and time series database.

Affected Software

1 affected componentFixes available

cleanstart/keda<2.18.3-r0

2.18.3-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/keda to a version that resolves this vulnerability.
Fixed in 2.18.3-r0

Event History

Nov 5, 2026

Advisory Published

via OSV·12:35 AM

Data Sourced

via OSV·12:35 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-44903

Frequently Asked Questions

Does exploitation require an authenticated account or user action?

No privileges are required, and the attack vector is network-based with low attack complexity. However, user interaction is required for exploitation.

What impact is reported if exploitation succeeds?

The reported impact is low confidentiality and low integrity impact, with no availability impact. The scope is changed, indicating the impact may extend beyond the vulnerable component's original security authority.

CLEANSTART-2026-ZW55727: Prometheus is an open-source monitoring system and time series database

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require an authenticated account or user action?

What impact is reported if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated account or user action?

What impact is reported if exploitation succeeds?