Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer (CVE-2026-40179)

CVE-2026-40179 describes stored XSS vulnerabilities in Prometheus web UI versions prior to 3.5.2 and between 3.6.0 and 3.11.1. The issue stems from metric names and label values being injected into innerHTML without proper escaping in multiple UI components such as chart tooltips and the Metric Explorer fuzzy search. Attackers able to inject malicious metrics via compromised scrape targets or receivers can execute arbitrary JavaScript in the browsers of users viewing these UI components. This can result in sensitive configuration data exfiltration, deletion of data, or service shutdown depending on the features enabled. The vulnerabilities have been fixed in versions 3.5.2 and 3.11.2. Mitigation strategies include restricting access to remote write and OTLP receivers, trusting scrape targets, disabling administrative or mutating API endpoints in untrusted environments, and avoiding untrusted links that may create poisoned labels.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of Prometheus users viewing affected UI components. This can lead to exfiltration of configuration data, deletion of data, or shutdown of the Prometheus service depending on enabled features. The vulnerability requires the attacker to inject malicious metrics via compromised scrape targets or receivers.

A fix is available in Prometheus versions 3.5.2 and 3.11.2. Users should upgrade to these or later versions to remediate the vulnerability. Additional mitigations include restricting exposure of remote write and OTLP receivers, trusting scrape targets, disabling administrative or mutating API endpoints in untrusted environments, and avoiding untrusted links that may generate poisoned labels.