Go - OSV

GO-2026-5662

Go/github.com/prometheus/prometheus

Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus 25 Jun

Fix available

GO-2026-5710

Go/github.com/prometheus/prometheus

Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus 25 Jun

Fix available

GO-2026-5381

Go/github.com/prometheus/prometheus

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus 25 Jun

Fix available

GO-2026-5264

Go/github.com/prometheus/prometheus
Go/github.com/prometheus/prometheus/v2

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus 25 Jun

Fix available

GHSA-fw8g-cg8f-9j28

Go/github.com/prometheus/prometheus

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display 05 May

Fix available
Severity - 5.1 (Medium)

GHSA-8rm2-7qqf-34qm

Go/github.com/prometheus/prometheus

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload 05 May

Fix available
Severity - 7.5 (High)

GHSA-wg65-39gg-5wfj

Go/github.com/prometheus/prometheus

Prometheus Azure AD remote write OAuth client secret exposed via config API 05 May

Fix available
Severity - 7.5 (High)

GHSA-vffh-x6r8-xx99

Go/github.com/prometheus/prometheus

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer 13 Apr

Fix available
Severity - 5.3 (Medium)

GHSA-4v48-4q5m-8vx4

Go/github.com/prometheus/prometheus
Go/github.com/prometheus/prometheus/v2

Prometheus vulnerable to basic authentication bypass 05 Dec 2022

Fix available
Severity - 7.2 (High)

GHSA-vx57-7f4q-fpc7

Go/github.com/prometheus/prometheus

Arbitrary redirects under /new endpoint 15 Feb 2022

Fix available
Severity - 6.1 (Medium)

Vulnerabilities