CVE-2026-119566: Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Prometheus deployments through 3.15.1 that use remote_write with Azure AD or Google IAM bearer-token authentication are exposed if the configured remote-write endpoint, or a server it can redirect through, is attacker-controlled or compromised.
What must an attacker do to exploit it?
The attacker must control the remote-write endpoint or a redirecting server and return an HTTP 3xx redirect to a host they control. Prometheus can then send the Azure AD or Google IAM bearer token to that other host.
What is the likely impact of a stolen token?
An attacker can replay the captured bearer token. The provided example is using it to write metrics to the victim's backend.