From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the… (CVE-2026-44903)
Description
A stored cross-site scripting (XSS) vulnerability exists in the legacy Prometheus web UI's histogram heatmap chart view. This occurs because label values for histogram buckets are not properly escaped when rendered as axis tick marks in HTML. An attacker able to inject crafted metrics can execute arbitrary JavaScript in the browsers of users viewing the affected heatmap UI. The vulnerability affects multiple Prometheus versions prior to 3.5.3 and 3.11.3 where the legacy UI is enabled. Fixed versions 3.5.3 and 3.11.3 address this issue.
CVSS v3.1
Score 6.1medium
Affected software
pkg:bitnami/prometheuspkg:deb/ubuntu/prometheus?arch=source&distro=xenialpkg:deb/ubuntu/prometheus?arch=source&distro=bionicpkg:deb/ubuntu/prometheus?arch=source&distro=focalpkg:deb/ubuntu/prometheus?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/prometheus?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/prometheus?arch=source&distro=questingpkg:deb/ubuntu/prometheus?arch=source&distro=stonkingpkg:deb/ubuntu/prometheus?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Prometheus versions from 2.49.0 up to but not including 3.5.3, and from 3.6.0 up to but not including 3.11.3, the legacy web UI (enabled via --enable-feature=old-ui) contains a stored XSS vulnerability in the histogram heatmap chart. The vulnerability arises because the bucket label values are inserted into the HTML for axis tick marks without proper escaping, allowing injected JavaScript to execute in the context of any user viewing the heatmap chart. This flaw is fixed in versions 3.5.3 and 3.11.3.
Potential Impact
An attacker who can inject specially crafted metrics into the Prometheus server can cause arbitrary JavaScript execution in the browsers of users who view the histogram heatmap chart in the legacy UI. This could lead to session hijacking, credential theft, or other malicious actions within the context of the Prometheus web UI. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in Prometheus versions 3.5.3 and 3.11.3. Users should upgrade to one of these versions or later to remediate the issue. If upgrading is not immediately possible, disabling the legacy web UI by not enabling the --enable-feature=old-ui flag will mitigate exposure. No other vendor advisories indicate alternative mitigations.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-prometheus-2026-44903
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-44903"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6a577ed068715ace43b3f49c
Added to database: 07/15/2026, 12:36:32 UTC
Last enriched: 09/08/2026, 15:12:49 UTC
Last updated: 10/17/2026, 22:20:25 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.