Medium severity · published Mar 26, 2019
CVE-2019-3826
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1
6.1
CVSS
2.6%
EPSS
No
On KEV
Description
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Openshift Container Platform · Redhat
3.11 · source: NVD
PR
Prometheus · Prometheus
before 2.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3826
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3826
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0327
advisory.checkmarx.net
https://advisory.checkmarx.net/advisory/CX-2019-4297
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3826
Patch
https://github.com/prometheus/prometheus/commit/62e591f9
Patch
https://github.com/prometheus/prometheus/pull/5163
lists.apache.org
https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E
More from Prometheus
7.5
CVE-2026-42154
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
7.5
CVE-2026-42151
Prometheus Azure AD remote write OAuth client secret exposed via config API
6.1
CVE-2026-44903
Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI
6.1
CVE-2026-40179
Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer
6.1
CVE-2021-29622
Prometheus is an open-source monitoring system and time series database