v3.13.1
2026-07-10T08:51:40Z•57672146c5df915546118d751b29a1892b53addcb1a69e0166466fb63ea6d88f
LTSSTACKIT-SDcross-site-scriptingdependency-updategolangopen-telemetryprometheusredirect-credentialsreleasesanitize-htmlsecrets-exposuresecurityxss
What happened
Multiple Prometheus releases in June–July 2026 include security fixes and dependency updates. Notable fixes: bumped sanitize-html to remediate a cross-site scripting vulnerability (CVE-2026-44990) in the 3.13.x line and CVE-2026-53606 in 3.5.5; fix for STACKIT SD secrets being exposed via the /-/config endpoint (GHSA-39j6-789q-qxvh); HTTP client change to avoid forwarding credentials on cross-host redirects addressing advisories tied to CVE-2025-4673 and CVE-2023-45289; and updates to golang.org/x/net and OpenTelemetry to remediate GO-2026-* issues. Releases referenced: 3.13.0 (LTS), 3.13.0-rc
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- prometheus_prometheus_releases
- Record identifier
- 57672146c5df915546118d751b29a1892b53addcb1a69e0166466fb63ea6d88f
- Enrichment time
- 2026-07-10T08:51:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.