Prometheus <=3.15.1 remote_write token leak (Azure AD/Google IAM)
CVE-2026-119566 Published on October 30, 2026
Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
Vulnerability Analysis
CVE-2026-119566 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Products Associated with CVE-2026-119566
Want to know whenever a new CVE is published for Prometheus? stack.watch will email you.
Affected Versions
prometheus:- Before and including 3.15.1 is affected.