Prometheus CVE-2026-44903

Upgrade Prometheus to version 3.5.3 or 3.11.3, which contain the fix confirmed in commit 38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d (https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d). The patch adds escapeHTML() around the le label value in the heatmap tick formatter and fully resolves the vulnerability. If upgrading immediately is not possible, the most effective workaround is removing the --enable-feature=old-ui command-line flag - this disables the vulnerable code path entirely with no monitoring functionality loss since the modern UI is the default. If the legacy UI cannot be disabled, apply the following compensating controls: restrict or disable the remote write receiver (--web.enable-remote-write-receiver) and OTLP receiver (--web.enable-otlp-receiver) if not required, as these are primary external injection vectors; audit and confirm all scrape targets are trusted and not under adversarial control; do not enable --web.enable-admin-api or --web.enable-lifecycle if untrusted metric sources are present, as XSS could be used to invoke those endpoints. Note that scrape target trust is an operational control - network-level restrictions or allowlisting may be required to enforce it reliably.