Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-44903 · CVE overview and exploitation status

EUVD-2026-32008

GHSA-fw8g-cg8f-9j28

BIT-prometheus-2026-44903

GO-2026-5381

cve-program · CVE-2026-44903

• https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28
• https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d

euvd · EUVD-2026-32008

• https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28
• https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d

nvd · CVE-2026-44903

• https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d
• https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28

osv · GHSA-fw8g-cg8f-9j28

• https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28
• https://nvd.nist.gov/vuln/detail/CVE-2026-44903
• https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d
• https://github.com/prometheus/prometheus

osv · GO-2026-5381

• https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28
• https://nvd.nist.gov/vuln/detail/CVE-2026-44903
• https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d

No related changes are available here.