Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1002104.json"