Prometheus
CVE-2026-0528
MEDIUM
GHSA-w2gr-585j-r428
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Array index validation
|
| Impact | CVSS 6.5 (MEDIUM). Attack vector: Adjacent Network. Complexity: Low. Privileges required: None. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specia. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Denial of Service in Prometheus and Kibana metricsets can be triggered by sending specially crafted malformed payloads to Graphite, Zookeeper, or Prometheus data sources due to improper array index validation and input validation flaws. An unauthenticated attacker on the network can exploit this to crash monitoring services without user interaction. No patch is currently available.
Earlier versions of this analysis (1)
Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. [CVSS 6.5 MEDIUM]
RemediationAI
Monitor vendor advisories for a patch.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-129 (Improper Validation of Array Index). Affects the Prometheus helper component of Kibana. Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric
Know when Prometheus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.
Executive ViewAI
Organizations using Metricbeat can allow an attacker to cause a Denial of Service should be aware of notable risk from CVE-2026-0528 rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Prometheus
View allPrometheus Exporter Toolkit is a utility package to build exporters. Rated high severity (CVSS 8.8), this vulnerability
Unsafe PHP deserialization in openITCOCKPIT Community Edition 5.3.1 and earlier allows authenticated attackers to inject
Remote code execution in openITCOCKPIT 5.3.1 and earlier via unsafe deserialization in the Gearman worker component, whi
Memory exhaustion in Prometheus remote read endpoint allows unauthenticated attackers to crash the monitoring server via
Prometheus monitoring system exposes Azure AD OAuth client secrets in plaintext via its /-/config HTTP API endpoint. Ver
Prometheus is an open-source monitoring system and time series database. Rated medium severity (CVSS 6.1), this vulnerab
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. Rated medium severity (CVSS 5.8), this vulnerabi
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. Rated high severity
Scraparr versions 3.0.0-beta through 3.0.1 expose Readarr API keys in plaintext through the /metrics endpoint when the R
Prometheus through 3.15.1 can expose Azure AD or Google IAM bearer tokens when remote_write follows an HTTP 3xx redirect
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. Rated medium severity
Alertmanager handles alerts sent by client applications such as the Prometheus server. Rated medium severity (CVSS 5.4),
Same weakness CWE-129 – Improper Validation of Array Index
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB