CVE-2026-44903 Details
Description
Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.
A stored cross-site scripting vulnerability has been identified in the Prometheus server's legacy web UI, specifically in versions 2.49.0 prior to 3.5.3 and 3.11.3. When the heatmap chart view is used, the histogram bucket label values are not properly escaped before being inserted into the HTML as axis tick mark labels. This flaw allows an attacker who can inject crafted metrics to execute JavaScript in the browser of any user viewing the heatmap chart. The vulnerability is present when the legacy web UI is enabled via the command-line flag '--enable-feature=old-ui'.
Users can update to Prometheus versions 3.5.3 or 3.11.3, where this vulnerability has been patched. If an immediate update is not possible, the legacy web UI can be disabled by removing the '--enable-feature=old-ui' command-line flag. For users who must keep the old UI enabled, it is recommended to ensure that scrape targets are trusted and not under attacker control, and to avoid clicking untrusted links that could inject malicious label data.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d | [email protected] | Patch |
| https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28 | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| prometheus prometheus | >= 2.49.0, < 3.5.3 >= 3.6.0, < 3.11.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | New CVE Received | [email protected] |