UBUNTU-CVE-2026-119566: Medium severity ubuntu/golang-github-prometheus-common vulnerability
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remotewrite requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Prometheus through 3.15.1 are exposed when remote_write uses Azure AD or Google IAM bearer tokens and the configured remote-write endpoint is attacker-controlled or can redirect requests to an attacker-controlled host.
What does an attacker need to exploit this?
The attacker needs control of the remote-write endpoint or of a server that can return a 3xx redirect to their host. The provided vector indicates no prior privileges or user interaction are required, although exploitation has high attack complexity.