{"id":"CVE-2026-119566","aliases":[],"cve":{"records":[{"id":"CVE-2026-119566","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T10:53:31.951Z","published":"2026-10-30T11:31:13.086Z","modified":"2026-10-30T11:31:13.086Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T11:31:13.086Z"}],"references":[{"url":"https://github.com/prometheus/prometheus/blob/v3.15.1/storage/remote/azuread/azuread.go#L326-L333","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/prometheus/prometheus/blob/v3.15.1/storage/remote/client.go#L205-L216","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/prometheus/common/pull/901","tags":["related","patch","issue-tracking"],"source":"VulnCheck"},{"url":"https://abraxaslabs.tech/research/prometheus-bearer-redirect","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/prometheus/prometheus","tags":["product"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/prometheus-through-3.15.1-credential-leak-via-remote-write-cross-host-redirects","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-522","description":"Insufficiently Protected Credentials","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*","versionEndIncluding":"3.15.1"}]}]}]}],"prioritization":[]},"title":"Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.","score":6.3,"severity":"medium","published":"2026-10-30T11:31:13.086Z","modified":"2026-10-30T11:31:13.086Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"prometheus","name":"prometheus","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.15.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:github/prometheus/prometheus","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119566"}],"remediation":[],"references":["https://github.com/prometheus/prometheus/blob/v3.15.1/storage/remote/azuread/azuread.go#L326-L333","https://github.com/prometheus/prometheus/blob/v3.15.1/storage/remote/client.go#L205-L216","https://github.com/prometheus/common/pull/901","https://abraxaslabs.tech/research/prometheus-bearer-redirect","https://github.com/prometheus/prometheus","https://www.vulncheck.com/advisories/prometheus-through-3.15.1-credential-leak-via-remote-write-cross-host-redirects"],"sources":[{"name":"CVE","id":"CVE-2026-119566","modified":"2026-10-30T11:31:13.086Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119566"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8}],"sourceAffected":[],"observedAt":"2026-10-30T11:37:04.986Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T11:50:38.728Z","attemptedAt":"2026-10-30T11:50:38.728Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T11:50:37.336Z","attemptedAt":"2026-10-30T11:50:37.336Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T11:50:38.578Z","attemptedAt":"2026-10-30T11:50:38.578Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T11:50:36.718Z","attemptedAt":"2026-10-30T11:50:36.718Z"}],"evidence":[],"aiSummary":{"text":"Prometheus through 3.15.1 has a credential leak vulnerability via remote_write cross-host redirects, allowing attackers to capture Azure AD or Google IAM bearer tokens. Attackers need control of the remote-write endpoint or a redirecting server. The impact is a potential credential leak.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T11:41:23.407Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119566"}]}}