CVE-2026-119566
Received Received - Intake

Prometheus Credential Leak via Bearer Token Exposure

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119566
EUVD
EUVD-2026-113831

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
prometheus prometheus 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119566 is a credential leak vulnerability in Prometheus versions up to 3.15.1. It allows attackers to capture Azure AD or Google IAM bearer tokens by exploiting cross-host redirects in the remote_write functionality. Attackers controlling the remote-write endpoint or a redirecting server can issue a 3xx redirect response to their own host, capturing and replaying the victim's authentication token to gain unauthorized access to the victim's backend.

Detection Guidance

To detect this vulnerability, monitor HTTP traffic for cross-host redirects in Prometheus remote_write operations. Check Prometheus logs for 3xx redirect responses during remote_write requests. Inspect network traffic for unauthorized token replay attempts to Azure AD or Google IAM endpoints.

Impact Analysis

This vulnerability could allow attackers to steal authentication tokens used for cloud services like Azure Monitor or GCP Monitoring. If you use Prometheus with Azure AD or Google IAM authentication in remote_write setups, attackers might gain unauthorized access to your backend to write metrics or exfiltrate data. The impact includes potential data breaches, unauthorized access, and compromised monitoring systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected Prometheus versions may face regulatory penalties, loss of trust, and legal consequences due to potential data breaches or unauthorized access to regulated data.

Mitigation Strategies

Upgrade Prometheus to a version beyond 3.15.1 where the credential leak fix is implemented. Disable FollowRedirects in Prometheus configuration if cross-host redirects are not required. Review remote_write configurations to ensure no azuread or google_iam wrappers are used without proper validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119566. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart