SZB-7b0ac42a1e
EUVD lists Prometheus remote_write credential leak (EUVD-2026-113831)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Prometheus
- Product
- Prometheus
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a credential leak vulnerability in Prometheus through 3.15.1, scored 6.3/10 under CVSS v3.1. According to the listing, attackers controlling the remote-write endpoint or a redirect can capture Azure AD or Google IAM bearer tokens.
If you use Prometheus
Check whether any Prometheus deployment runs version 3.15.1 or earlier
Upgrade Prometheus to a release that the vendor marks as fixed
Rotate any Azure AD or Google IAM tokens used by remote_write configurations
Restrict remote_write destinations to trusted endpoints
What the sources say 1
· Mastodon: “Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host.” Source