What is the CVSS score of CVE-2026-0528?

CVE-2026-0528 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Prometheus are affected by CVE-2026-0528?

Organizations using Metricbeat can allow an attacker to cause a Denial of Service should be aware of notable risk from CVE-2026-0528 rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-0528?

Within 30 days: Identify affected systems running Metricbeat can allow an attacker to cause a Denial of Servic and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Prometheus CVE-2026-0528

MEDIUM

Improper Validation of Array Index (CWE-129)

2026-01-13 security@elastic.co

GHSA-w2gr-585j-r428

Prometheus Denial Of Service Kibana Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 13, 2026 - 21:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.

AnalysisAI

Denial of Service in Prometheus and Kibana metricsets can be triggered by sending specially crafted malformed payloads to Graphite, Zookeeper, or Prometheus data sources due to improper array index validation and input validation flaws. An unauthenticated attacker on the network can exploit this to crash monitoring services without user interaction. No patch is currently available.

Technical ContextAI

Classified as CWE-129 (Improper Validation of Array Index). Affects the Prometheus helper component of Kibana. Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric

RemediationAI

Monitor vendor advisories for a patch.

More in Prometheus

View all

CVE-2026-24892 HIGH This Week POC

7.5 Feb 20

Unsafe PHP deserialization in openITCOCKPIT Community Edition 5.3.1 and earlier allows authenticated attackers to inject

CVE-2026-24891 HIGH This Week POC

7.5 Feb 20

Remote code execution in openITCOCKPIT 5.3.1 and earlier via unsafe deserialization in the Gearman worker component, whi

CVE-2026-42154 HIGH This Week POC

7.5 May 04

Memory exhaustion in Prometheus remote read endpoint allows unauthenticated attackers to crash the monitoring server via

CVE-2026-42151 HIGH This Week POC

7.5 May 04

Prometheus monitoring system exposes Azure AD OAuth client secrets in plaintext via its /-/config HTTP API endpoint. Ver

CVE-2021-29622 MEDIUM This Month POC

6.1 May 19

Prometheus is an open-source monitoring system and time series database. Rated medium severity (CVSS 6.1), this vulnerab

CVE-2026-26069 HIGH This Week

7.5 Feb 12

Scraparr versions 3.0.0-beta through 3.0.1 expose Readarr API keys in plaintext through the /metrics endpoint when the R

CVE-2019-3826 MEDIUM This Month

6.1 Mar 26

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. Rated medium severity

CVE-2026-44903 MEDIUM This Month

5.1 May 26

Stored cross-site scripting in Prometheus versions 2.49.0 through 3.5.2/3.11.2 allows a low-privileged attacker who can

Same weakness CWE-129 – Improper Validation of Array Index

View all

CVE-2016-9053 CRITICAL POC

9.8

CVE-2020-27485 CRITICAL POC

9.9

CVE-2020-27483 CRITICAL POC

9.9

CVE-2024-24563 CRITICAL POC

9.8

CVE-2017-8797 HIGH

7.5

CVE-2018-11489 HIGH POC

8.8

CVE-2026-56770 HIGH POC

8.7

CVE-2017-7228 HIGH POC

8.2

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-0528 vulnerability details – vuln.today

Back

Prometheus CVE-2026-0528

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Prometheus

Same weakness CWE-129 – Improper Validation of Array Index

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code