Analysis and contextual insights are available on OpenCVE Cloud.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 04 Nov 2026 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 03 Nov 2026 00:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-201 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Fri, 30 Oct 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend. | |
| Title | Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects | |
| First Time appeared |
Prometheus
Prometheus prometheus |
|
| Weaknesses | CWE-522 | |
| CPEs | cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Prometheus
Prometheus prometheus |
|
| References |
|
|
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-04T22:20:14.999Z
Reserved: 2026-10-30T10:53:31.951Z
Link: CVE-2026-119566
Updated: 2026-11-04T22:20:10.641Z
Status : Awaiting Analysis
Published: 2026-10-30T12:16:44.287
Modified: 2026-11-04T23:17:20.063
Link: CVE-2026-119566
OpenCVE Enrichment
Updated: 2026-11-03T02:15:18Z