DEBIAN-CVE-2026-119566
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-119566
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-119566.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-119566
- Upstream
- Published
- 2026-10-30T12:16:44Z
- Modified
- 2026-11-01T09:00:06Z
- Severity
-
- 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
- References
Affected packages
Debian:12 / golang-github-prometheus-common
Package
- Name
- golang-github-prometheus-common
- Purl
- pkg:deb/debian/golang-github-prometheus-common?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
0.*
0.39.0-2
0.42.0-1
0.42.0-2
0.44.0-1
0.44.0-2
0.44.0-3
0.44.0-4
0.45.0-1
0.45.0-2
0.45.0-3
0.46.0-1
0.47.0-1
0.47.0-2
0.48.0-1
0.49.0-1
0.50.0-1
0.51.0-1
0.52.2-1
0.53.0-1
0.55.0-1
0.55.0-2
0.57.0-1
0.59.1-1
0.59.1-2
0.60.0-1
0.60.1-1
0.61.0-1
0.62.0-1
0.62.0-2
0.62.0-3
0.63.0-1
0.63.0-2
0.65.0-1
0.67.4-1
0.67.5-1
0.68.1-1
0.69.0-1
Debian:13 / golang-github-prometheus-common
Package
- Name
- golang-github-prometheus-common
- Purl
- pkg:deb/debian/golang-github-prometheus-common?arch=source&distro=trixie
Debian:14 / golang-github-prometheus-common
Package
- Name
- golang-github-prometheus-common
- Purl
- pkg:deb/debian/golang-github-prometheus-common?arch=source&distro=forky