CVE-2026-44903: 
Prometheus vulnerability analysis and mitigation

CVE-2026-44903 is a stored Cross-Site Scripting (XSS) vulnerability in the Prometheus monitoring system's legacy web UI. Affecting Prometheus versions 2.49.0 through before 3.5.3 and 3.6.0 through before 3.11.3, the flaw exists in the histogram heatmap chart view of the old UI (enabled via --enable-feature=old-ui), where le label values are inserted into HTML without escaping. An attacker who can inject crafted metrics can execute arbitrary JavaScript in the browser of any Prometheus user viewing the affected heatmap chart. The vulnerability was published on May 26, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): the legacy UI's Graph.tsx component used an unescaped le label value directly in the tickFormatter function for heatmap Y-axis tick labels, allowing raw HTML/JavaScript to be rendered in the browser (GitHub Commit). The fix replaced the raw label interpolation with a call to escapeHTML(). An attacker must be able to inject crafted metrics into Prometheus — achievable via a compromised scrape target, the remote write receiver (--web.enable-remote-write-receiver), or the OTLP receiver (--web.enable-otlp-receiver) — and the victim must view the poisoned metric in the heatmap chart UI of the legacy web interface (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any Prometheus user who views the malicious metric in the heatmap chart UI. From this XSS context, an attacker could read /api/v1/status/config to extract configuration data, call /-/quit to shut down Prometheus (if --web.enable-lifecycle is set), call /api/v1/admin/tsdb/delete_series to delete time series data (if --web.enable-admin-api is set), or exfiltrate metric data to an external server (GitHub Advisory). The vulnerability has low confidentiality and integrity impact with no availability impact at the system level, but the scope is changed as the browser context is affected.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control a metric ingestion path (scrape target, remote write, or OTLP) and the victim to use the explicitly opt-in legacy UI feature.

1. Gain metric injection access: Compromise a scrape target monitored by the Prometheus instance, or gain access to the remote write receiver (--web.enable-remote-write-receiver) or OTLP receiver (--web.enable-otlp-receiver) endpoint.
2. Craft a malicious histogram metric: Create a histogram metric with a crafted le label value containing a JavaScript payload, e.g., le="<img src=x onerror=alert(1)>" or a more sophisticated payload targeting Prometheus API endpoints.
3. Inject the metric: Push or expose the crafted metric so that Prometheus scrapes or ingests it into its time series database.
4. Wait for victim interaction: Wait for a Prometheus user who has enabled the legacy web UI (--enable-feature=old-ui) to navigate to the heatmap chart view of the poisoned histogram metric.
5. JavaScript executes: The unescaped le label value is rendered as HTML in the Y-axis tick labels of the heatmap chart, causing the injected JavaScript to execute in the victim's browser session, potentially enabling session hijacking, API abuse, or data exfiltration (GitHub Advisory, GitHub Commit).

• Metrics/TSDB: Histogram metrics with le label values containing HTML special characters (<, >, ", ') or JavaScript keywords (script, onerror, alert, fetch, etc.) in the Prometheus time series database.
• Network: Unexpected outbound HTTP requests from the Prometheus server or from user browsers to external hosts, particularly following access to heatmap chart views; unusual calls to /-/quit or /api/v1/admin/tsdb/delete_series in Prometheus access logs.
• Logs: Prometheus access logs showing requests to /api/v1/status/config or admin endpoints from unexpected sources or in unusual patterns shortly after a user views a heatmap chart.
• Scrape Targets: Scrape targets returning histogram metrics with anomalous or non-numeric le label values.

Upgrade Prometheus to version 3.5.3 or later (for the 2.49.0–3.5.x branch) or 3.11.3 or later (for the 3.6.0+ branch), which apply the fix by escaping le label values before HTML insertion (GitHub Advisory, GitHub Commit). If immediate patching is not possible, disable the legacy web UI by removing the --enable-feature=old-ui command-line flag. Additionally, ensure that remote write and OTLP receiver endpoints are not exposed to untrusted sources, verify that all scrape targets are trusted, and avoid enabling admin/mutating API endpoints (--web.enable-admin-api, --web.enable-lifecycle) when untrusted data ingestion cannot be prevented.

The vulnerability was reported by security researchers iiihaiii and ngocnn97 and published as a GitHub Security Advisory (GHSA-fw8g-cg8f-9j28) by Prometheus maintainer roidelapluie on April 27, 2026 (GitHub Advisory). The advisory references two prior similar vulnerabilities in Prometheus (CVE-2019-10215 and CVE-2026-40179), indicating a recurring pattern of XSS issues in the legacy UI. No significant broader media coverage or notable social media discussion beyond automated CVE tracking feeds has been observed.