3.13.0-rc.1 / 2026-06-22
2026-06-23T08:51:38Z•fe387d4cfabe10c15b51a24eed08862990855184c165031c38fbfd0315492ccf
/-/configAzureADCVE-2026-42151CVE-2026-44990DoSOpenTelemetrySTACKITUIXSSdependency-updatesgolang.org/x/netprometheusrelease-notesremote-readremote-writesanitize-htmlsecret-exposuresecuritysnappythird-party-licenses
What happened
Prometheus release notes (multiple 2026 releases including 3.13.0-rc.1, 3.5.4, 3.12.0, 3.11.3) describe several security fixes and dependency updates. Fixes include an XSS vulnerability in the UI (sanitize-html bumped, CVE-2026-44990), secret exposure issues that leaked OAuth/client secrets via the /-/config endpoint (including AzureAD client_secret, CVE-2026-42151) and STACKIT service discovery, and denial-of-service protections by rejecting snappy-compressed remote-write/remote-read payloads whose declared decoded length exceeds limits. Additional security hardening comes from dependency/upg
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- prometheus_prometheus_releases
- Record identifier
- fe387d4cfabe10c15b51a24eed08862990855184c165031c38fbfd0315492ccf
- Enrichment time
- 2026-06-23T08:51:38Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.