{"id":"UBUNTU-CVE-2026-119566","details":"Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.","modified":"2026-11-04T03:30:31.965940590Z","published":"2026-11-03T00:00:00Z","upstream":["CVE-2026-119566"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-119566"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-119566"},{"type":"REPORT","url":"https://github.com/prometheus/common/pull/901"},{"type":"REPORT","url":"https://abraxaslabs.tech/research/prometheus-bearer-redirect"},{"type":"REPORT","url":"https://github.com/prometheus/prometheus"},{"type":"REPORT","url":"https://github.com/prometheus/prometheus/blob/v3.15.1/storage/remote/azuread/azuread.go#L326-L333"},{"type":"REPORT","url":"https://github.com/prometheus/prometheus/blob/v3.15.1/storage/remote/client.go#L205-L216"},{"type":"REPORT","url":"https://www.vulncheck.com/advisories/prometheus-through-3.15.1-credential-leak-via-remote-write-cross-host-redirects"}],"affected":[{"package":{"name":"golang-github-prometheus-common","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/golang-github-prometheus-common?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0+git20160104.0a3005b-1"],"ecosystem_specific":{"binaries":[{"binary_name":"golang-github-prometheus-common-dev","binary_version":"0+git20160104.0a3005b-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119566.json"}},{"package":{"name":"golang-github-prometheus-common","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/golang-github-prometheus-common?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0+git20170707.3e6a763-1","0+git20171117.2e54d0b-1","0+git20180110.89604d1-1"],"ecosystem_specific":{"binaries":[{"binary_version":"0+git20180110.89604d1-1","binary_name":"golang-github-prometheus-common-dev"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119566.json"}},{"package":{"name":"golang-github-prometheus-common","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/golang-github-prometheus-common?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0+git20181119.b36ad28-2","0.7.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"golang-github-prometheus-common-dev","binary_version":"0.7.0-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119566.json"}},{"package":{"name":"golang-github-prometheus-common","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/golang-github-prometheus-common?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.0-2ubuntu1","0.32.1-5","0.32.1-5ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.32.1-5ubuntu1","binary_name":"golang-github-prometheus-common-dev"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119566.json"}},{"package":{"name":"golang-github-prometheus-common","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/golang-github-prometheus-common?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.44.0-4","0.45.0-3","0.46.0-1","0.47.0-2"],"ecosystem_specific":{"binaries":[{"binary_name":"golang-github-prometheus-common-dev","binary_version":"0.47.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119566.json"}},{"package":{"name":"golang-github-prometheus-common","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/golang-github-prometheus-common?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.62.0-3","0.67.4-1"],"ecosystem_specific":{"binaries":[{"binary_name":"golang-github-prometheus-common-dev","binary_version":"0.67.4-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119566.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}