CVE-2026-44903
Fixed in a distro release EPSS <1%CVSS 5.1
Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.
Products: prometheus
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/prometheus/prometheus | 0.311.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | agentbeat | 9.2.7-r8 |
| Chainguard | agentbeat-fips | 9.2.7-r9 |
| Chainguard | amazon-cloudwatch-agent | no fix |
| Chainguard | amazon-cloudwatch-agent-fips | no fix |
| Chainguard | amazon-cloudwatch-agent-operator | 3.5.0-r0 |
| Chainguard | amazon-cloudwatch-agent-operator-fips | 3.5.0-r0 |
| Chainguard | aws-otel-collector | 0.49.0-r0 |
| Chainguard | aws-otel-collector-fips | 0.49.0-r0 |
| Chainguard | certificate-transparency-fips-trillian-ctserver | 1.3.3-r8 |
| Chainguard | certificate-transparency-trillian-ctserver | 1.3.3-r8 |
| Chainguard | cloud-sql-proxy-2.16 | 2.16.0-r20 |
| Chainguard | cloud-sql-proxy-2.17 | 2.17.1-r17 |
| Chainguard | cloud-sql-proxy-2.18 | 2.18.3-r10 |
| Chainguard | cloud-sql-proxy-2.21 | 2.21.3-r1 |
| Chainguard | cloud-sql-proxy-fips | 2.21.3-r1 |
| Chainguard | cloudzero-collector | 1.2.11-r3 |
| Chainguard | cloudzero-collector-fips | 1.2.11-r1 |
| Chainguard | cloudzero-regurgitator | 1.2.11-r3 |
| Chainguard | cloudzero-regurgitator-fips | 1.2.11-r1 |
| Chainguard | cloudzero-shipper | 1.2.11-r3 |
| Chainguard | cloudzero-shipper-fips | 1.2.11-r1 |
| Chainguard | cloudzero-webhook | 1.2.11-r3 |
| Chainguard | cloudzero-webhook-fips | 1.2.11-r1 |
| Chainguard | commercial-grafana-11.6 | no fix |
| Chainguard | commercial-grafana-12.1 | no fix |
| Chainguard | commercial-grafana-12.2 | no fix |
| Chainguard | commercial-grafana-12.3 | no fix |
| Chainguard | commercial-grafana-12.4 | 12.4.10-r0 |
| Chainguard | commercial-grafana-13.0 | no fix |
| Chainguard | cortex | no fix |
| Chainguard | cortex-fips | no fix |
| Chainguard | cortex-geomys-fips | no fix |
| Chainguard | datadog-agent-7.71-full | no fix |
| Chainguard | datadog-agent-7.72-full | no fix |
| Chainguard | datadog-agent-7.73-full | no fix |
| Chainguard | datadog-agent-7.74-full | no fix |
| Chainguard | datadog-agent-7.75 | no fix |
| Chainguard | datadog-agent-7.75-full | no fix |
| Chainguard | datadog-agent-7.76 | no fix |
| Chainguard | datadog-agent-7.76-full | no fix |
| Chainguard | datadog-agent-7.77 | 7.77.3-r10 |
| Chainguard | datadog-agent-7.77-full | 7.77.3-r10 |
| Chainguard | datadog-agent-7.78 | 7.78.4-r3 |
| Chainguard | datadog-agent-7.78-full | 7.78.4-r3 |
| Chainguard | datadog-agent-fips-7.71-full | no fix |
| Chainguard | datadog-agent-fips-7.72-full | no fix |
| Chainguard | datadog-agent-fips-7.73-full | no fix |
| Chainguard | datadog-agent-fips-7.74-full | no fix |
| Chainguard | datadog-agent-fips-7.75 | no fix |
| Chainguard | datadog-agent-fips-7.75-full | no fix |
| Chainguard | datadog-agent-fips-7.76 | no fix |
| Chainguard | datadog-agent-fips-7.76-full | no fix |
| Chainguard | datadog-agent-fips-7.77 | 7.77.3-r10 |
| Chainguard | datadog-agent-fips-7.77-full | 7.77.3-r10 |
| Chainguard | datadog-agent-fips-7.78 | 7.78.4-r3 |
| Chainguard | datadog-agent-fips-7.78-full | 7.78.4-r3 |
| Chainguard | datadog-cluster-agent-7.75 | no fix |
| Chainguard | datadog-cluster-agent-7.76 | no fix |
| Chainguard | datadog-cluster-agent-7.77 | 7.77.3-r10 |
| Chainguard | datadog-cluster-agent-7.78 | 7.78.4-r3 |
| Chainguard | datadog-cluster-agent-fips-7.75 | no fix |
| Chainguard | datadog-cluster-agent-fips-7.76 | no fix |
| Chainguard | datadog-cluster-agent-fips-7.77 | 7.77.3-r10 |
| Chainguard | datadog-cluster-agent-fips-7.78 | 7.78.4-r3 |
| Chainguard | elastic-agent-8.19 | 8.19.15-r4 |
| Chainguard | elastic-agent-9.1 | no fix |
| Chainguard | elastic-agent-9.2 | 9.2.8-r8 |
| Chainguard | elastic-agent-fips-8.19 | 8.19.16-r0 |
| Chainguard | elastic-agent-fips-9.1 | no fix |
| Chainguard | elastic-agent-fips-9.2 | no fix |
| Chainguard | elastic-otel-collector-9.3 | 9.3.5-r0 |
| Chainguard | elastic-otel-collector-9.4 | 9.4.1-r1 |
| Chainguard | elastic-otel-collector-fips-9.3 | 9.3.4-r3 |
| Chainguard | elastic-otel-collector-fips-9.4 | 9.4.1-r1 |
| Chainguard | fluent-bit-plugin-loki | 3.7.2-r1 |
| Chainguard | google-cloud-otel-ops-collector | 0.154.0-r0 |
| Chainguard | grafana-11.6 | no fix |
| Chainguard | grafana-12.0 | no fix |
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-12.2 | no fix |
| Chainguard | grafana-12.3 | no fix |
| Chainguard | grafana-12.4 | 12.4.10-r0 |
| Chainguard | grafana-13.0 | no fix |
| Chainguard | grafana-fips-11.6 | no fix |
| Chainguard | grafana-fips-12.0 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | no fix |
| Chainguard | grafana-fips-12.3 | no fix |
| Chainguard | grafana-fips-12.4 | 12.4.10-r0 |
| Chainguard | grafana-fips-13.0 | no fix |
| Chainguard | grafana-pyroscope-1.12 | no fix |
| Chainguard | grafana-pyroscope-1.13 | no fix |
| Chainguard | grafana-pyroscope-1.14 | no fix |
| Chainguard | grafana-pyroscope-1.15 | no fix |
| Chainguard | grafana-pyroscope-1.16 | no fix |
| Chainguard | grafana-pyroscope-1.17 | no fix |
| Chainguard | grafana-pyroscope-1.18 | no fix |
| Chainguard | grafana-pyroscope-1.19 | no fix |
| Chainguard | grafana-pyroscope-1.20 | no fix |
| Chainguard | istio-pilot-discovery-1.26 | no fix |
| Chainguard | istio-pilot-discovery-1.27 | no fix |
| Chainguard | istio-pilot-discovery-1.28 | 0 |
| Chainguard | istio-pilot-discovery-1.29 | 1.29.2-r3 |
| Chainguard | istio-pilot-discovery-fips-1.26 | no fix |
| Chainguard | istio-pilot-discovery-fips-1.27 | no fix |
| Chainguard | istio-pilot-discovery-fips-1.28 | 1.28.6-r4 |
| Chainguard | istio-pilot-discovery-fips-1.29 | 1.29.2-r3 |
| Chainguard | istioctl-1.26 | no fix |
| Chainguard | istioctl-1.27 | no fix |
| Chainguard | istioctl-1.28 | 0 |
| Chainguard | istioctl-1.29 | 1.29.2-r3 |
| Chainguard | jaeger-1-jaeger | no fix |
| Chainguard | jaeger-2-all-in-one-compat | no fix |
| Chainguard | jaeger-2-fips-jaeger | 2.17.0-r4 |
| Chainguard | jaeger-2-fips-query | no fix |
| Chainguard | jaeger-2-jaeger | 2.17.0-r7 |
| Chainguard | k8sgpt | 0.4.36-r1 |
| Chainguard | k8sgpt | 0.4.38-r3 |
| Chainguard | karma | 0.129-r2 |
| Chainguard | karma-fips | 0.129-r3 |
| Chainguard | keda-2.17 | no fix |
| Chainguard | keda-2.17-metrics-apiserver | no fix |
| Chainguard | keda-2.18 | 2.18.3-r11 |
| Chainguard | keda-2.18-metrics-apiserver | 2.18.3-r11 |
| Chainguard | keda-2.19 | 2.19.0-r15 |
| Chainguard | keda-2.19-metrics-apiserver | 2.19.0-r15 |
| Chainguard | keda-fips-2.17 | no fix |
| Chainguard | keda-fips-2.17-metrics-apiserver | no fix |
| Chainguard | keda-fips-2.18 | 2.18.3-r11 |
| Chainguard | keda-fips-2.18-metrics-apiserver | 2.18.3-r11 |
| Chainguard | keda-fips-2.19 | 2.19.0-r10 |
| Chainguard | keda-fips-2.19-metrics-apiserver | 2.19.0-r10 |
| Chainguard | ld-relay | 8.19.1-r1 |
| Chainguard | ld-relay-fips | 8.19.1-r1 |
| Chainguard | loki-2.9 | no fix |
| Chainguard | loki-2.9-logcli | no fix |
| Chainguard | loki-2.9-loki-canary | no fix |
| Chainguard | loki-2.9-promtail | no fix |
| Chainguard | loki-3.4 | no fix |
| Chainguard | loki-3.4-logcli | no fix |
| Chainguard | loki-3.4-loki-canary | no fix |
| Chainguard | loki-3.4-promtail | no fix |
| Chainguard | loki-3.5 | no fix |
| Chainguard | loki-3.5-logcli | no fix |
| Chainguard | loki-3.5-loki-canary | no fix |
| Chainguard | loki-3.5-promtail | no fix |
| Chainguard | loki-3.6 | 3.6.12-r0 |
| Chainguard | loki-3.6-logcli | 3.6.12-r0 |
| Chainguard | loki-3.6-loki-canary | 3.6.12-r0 |
| Chainguard | loki-3.6-promtail | 3.6.12-r0 |
| Chainguard | loki-3.7 | 3.7.2-r1 |
| Chainguard | loki-3.7-logcli | 3.7.2-r1 |
| Chainguard | loki-3.7-loki-canary | 3.7.2-r1 |
| Chainguard | loki-fips-2.9 | no fix |
| Chainguard | loki-fips-2.9-logcli | no fix |
| Chainguard | loki-fips-2.9-loki-canary | no fix |
| Chainguard | loki-fips-2.9-promtail | no fix |
| Chainguard | loki-fips-3.4 | no fix |
| Chainguard | loki-fips-3.4-logcli | no fix |
| Chainguard | loki-fips-3.4-loki-canary | no fix |
| Chainguard | loki-fips-3.4-promtail | no fix |
| Chainguard | loki-fips-3.5 | no fix |
| Chainguard | loki-fips-3.5-logcli | no fix |
| Chainguard | loki-fips-3.5-loki-canary | no fix |
| Chainguard | loki-fips-3.5-promtail | no fix |
| Chainguard | loki-fips-3.6 | 3.6.11-r2 |
| Chainguard | loki-fips-3.6-logcli | 3.6.11-r2 |
| Chainguard | loki-fips-3.6-loki-canary | 3.6.11-r2 |
| Chainguard | loki-fips-3.6-promtail | 3.6.11-r2 |
| Chainguard | loki-fips-3.7 | 3.7.2-r1 |
| Chainguard | loki-fips-3.7-logcli | 3.7.2-r1 |
| Chainguard | loki-fips-3.7-loki-canary | 3.7.2-r1 |
| Chainguard | mc | 0.20250813.083541-r11 |
| Chainguard | mc-fips | 0.20250813.083541-r12 |
| Chainguard | mcp-grafana | 0.13.1-r1 |
| Chainguard | mcp-grafana-fips | 0.13.1-r1 |
| Chainguard | metricbeat-8.17 | no fix |
| Chainguard | metricbeat-8.19 | 8.19.19-r0 |
| Chainguard | metricbeat-9.0 | no fix |
| Chainguard | metricbeat-9.1 | no fix |
| Chainguard | metricbeat-9.2 | 9.2.8-r7 |
| Chainguard | metricbeat-9.3 | 9.3.6-r2 |
| Chainguard | metricbeat-9.4 | 9.4.1-r4 |
| Chainguard | metricbeat-fips-8.17 | no fix |
| Chainguard | metricbeat-fips-8.19 | 8.19.15-r5 |
| Chainguard | metricbeat-fips-9.0 | no fix |
| Chainguard | metricbeat-fips-9.1 | no fix |
| Chainguard | metricbeat-fips-9.2 | 9.2.8-r9 |
| Chainguard | metricbeat-fips-9.3 | 9.3.8-r0 |
| Chainguard | metricbeat-fips-9.4 | 9.4.1-r1 |
| Chainguard | metrics-server | 0.8.1-r8 |
| Chainguard | metrics-server-fips | 0.9.0-r0 |
| Chainguard | minio | 0.20260512.133534-r0 |
| Chainguard | minio-fips | 0.20260512.133534-r0 |
| Chainguard | minio-object-browser | 2.0.4-r14 |
| Chainguard | minio-object-browser-fips | 2.0.4-r13 |
| Chainguard | minio-operator | 7.1.1-r28 |
| Chainguard | minio-operator-compat | 7.1.1-r33 |
| Chainguard | minio-operator-fips | 7.1.1-r18 |
| Chainguard | minio-operator-sidecar | 7.1.1-r28 |
| Chainguard | minio-operator-sidecar-fips | 7.1.1-r18 |
| Chainguard | node-problem-detector-0.8 | 0.8.25-r5 |
| Chainguard | node-problem-detector-1.35 | 1.35.2-r12 |
| Chainguard | node-problem-detector-fips-0.8 | 0.8.25-r7 |
| Chainguard | nrdot-collector-k8s | 1.12.0-r4 |
| Chainguard | nrdot-collector-k8s-fips | 1.12.0-r4 |
| Chainguard | opentelemetry-collector | 0.152.1-r0 |
| Chainguard | opentelemetry-collector-contrib | 0.152.0-r0 |
| Chainguard | opentelemetry-collector-contrib-fips | 0.152.0-r0 |
| Chainguard | opentelemetry-collector-fips | 0.152.0-r0 |
| Chainguard | opentelemetry-operator-fips-otel-allocator | 0.151.0-r0 |
| Chainguard | opentelemetry-operator-otel-allocator | 0.150.0-r1 |
| Chainguard | ops-agent | 2.67.0-r0 |
| Chainguard | ops-agent-wrapper | 2.67.0-r0 |
| Chainguard | percona-grafana | 0 |
| Chainguard | prometheus-2.51 | no fix |
| Chainguard | prometheus-3.10 | no fix |
| Chainguard | prometheus-3.5 | 3.5.3-r1 |
| Chainguard | prometheus-3.7 | no fix |
| Chainguard | prometheus-3.8 | no fix |
| Chainguard | prometheus-3.9 | no fix |
| Chainguard | prometheus-fips-3.10 | no fix |
| Chainguard | prometheus-fips-3.5 | 3.5.3-r3 |
| Chainguard | prometheus-fips-3.7 | no fix |
| Chainguard | prometheus-fips-3.8 | no fix |
| Chainguard | prometheus-fips-3.9 | no fix |
| Chainguard | prometheus-pushgateway | 1.11.2-r10 |
| Chainguard | prometheus-pushgateway-fips | 1.11.2-r10 |
| Chainguard | pyrra | no fix |
| Chainguard | pyrra-fips | no fix |
| Chainguard | sloth | 0 |
| Chainguard | sloth-fips | 0 |
| Chainguard | splunk-otel-collector | 0.152.0-r0 |
| Chainguard | splunk-otel-collector-fips | 0.152.0-r0 |
| Chainguard | telegraf-1.35 | no fix |
| Chainguard | telegraf-1.36 | no fix |
| Chainguard | telegraf-1.37 | no fix |
| Chainguard | telegraf-1.38 | 1.38.3-r3 |
| Chainguard | tempo-2.10 | 2.10.6-r0 |
| Chainguard | tempo-2.10-cli | 2.10.6-r0 |
| Chainguard | tempo-2.10-vulture | 2.10.6-r0 |
| Chainguard | tempo-2.8 | no fix |
| Chainguard | tempo-2.8-cli | no fix |
| Chainguard | tempo-2.8-vulture | no fix |
| Chainguard | tempo-2.9 | 2.9.4-r0 |
| Chainguard | tempo-2.9-cli | 2.9.4-r0 |
| Chainguard | tempo-2.9-vulture | 2.9.4-r0 |
| Chainguard | tempo-fips-2.10 | 2.10.6-r0 |
| Chainguard | tempo-fips-2.10-cli | 2.10.6-r0 |
| Chainguard | tempo-fips-2.10-vulture | 2.10.6-r0 |
| Chainguard | tempo-fips-2.8 | no fix |
| Chainguard | tempo-fips-2.8-cli | no fix |
| Chainguard | tempo-fips-2.8-vulture | no fix |
| Chainguard | tempo-fips-2.9 | 2.9.4-r0 |
| Chainguard | tempo-fips-2.9-cli | 2.9.4-r0 |
| Chainguard | tempo-fips-2.9-vulture | 2.9.4-r0 |
| Chainguard | thanos | no fix |
| Chainguard | thanos-fips | no fix |
| Chainguard | thanos-receive-controller | no fix |
| Chainguard | thanos-receive-controller-fips | no fix |
| Chainguard | trillian-fips-logserver | 1.7.3-r4 |
| Chainguard | trillian-fips-logsigner | 1.7.3-r4 |
| Chainguard | trillian-logserver | 1.7.3-r5 |
| Chainguard | trillian-logsigner | 1.7.3-r5 |
| Debian 13 | prometheus | no fix |
| Debian 14 | prometheus | 3.5.3+ds1-1 |
| Ubuntu 16.04 LTS | prometheus | no fix |
| Ubuntu 18.04 LTS | prometheus | no fix |
| Ubuntu 20.04 LTS | prometheus | no fix |
| Ubuntu 25.10 | prometheus | no fix |
| Ubuntu 26.10 | prometheus | no fix |
| Ubuntu Pro 22.04 LTS | prometheus | no fix |
| Ubuntu Pro 24.04 LTS | prometheus | no fix |
| Ubuntu Pro 26.04 LTS | prometheus | no fix |
| Wolfi | amazon-cloudwatch-agent | no fix |
| Wolfi | amazon-cloudwatch-agent-operator | 3.5.0-r0 |
| Wolfi | aws-otel-collector | 0.49.0-r0 |
| Wolfi | certificate-transparency-trillian-ctserver | 1.3.3-r8 |
| Wolfi | cloud-sql-proxy-2.16 | 2.16.0-r20 |
| Wolfi | cloud-sql-proxy-2.21 | 2.21.3-r1 |
| Wolfi | cortex | no fix |
| Wolfi | datadog-agent-7.72-full | no fix |
| Wolfi | datadog-agent-7.73-full | no fix |
| Wolfi | datadog-agent-7.75 | no fix |
| Wolfi | datadog-agent-7.76 | no fix |
| Wolfi | datadog-agent-7.77 | 7.77.3-r10 |
| Wolfi | datadog-agent-7.77-full | 7.77.3-r10 |
| Wolfi | datadog-agent-7.78 | 7.78.4-r3 |
| Wolfi | datadog-agent-7.78-full | 7.78.4-r3 |
| Wolfi | datadog-cluster-agent-7.75 | no fix |
| Wolfi | datadog-cluster-agent-7.76 | no fix |
| Wolfi | datadog-cluster-agent-7.77 | 7.77.3-r10 |
| Wolfi | datadog-cluster-agent-7.78 | 7.78.4-r3 |
| Wolfi | fluent-bit-plugin-loki | 3.7.2-r1 |
| Wolfi | grafana-12.3 | no fix |
| Wolfi | grafana-12.4 | 12.4.10-r0 |
| Wolfi | grafana-13.0 | no fix |
| Wolfi | grafana-pyroscope-1.18 | no fix |
| Wolfi | grafana-pyroscope-1.19 | no fix |
| Wolfi | istio-pilot-discovery-1.28 | 0 |
| Wolfi | istio-pilot-discovery-1.29 | 1.29.2-r3 |
| Wolfi | istioctl-1.27 | no fix |
| Wolfi | istioctl-1.28 | 0 |
| Wolfi | istioctl-1.29 | 1.29.2-r3 |
| Wolfi | jaeger-2-all-in-one-compat | no fix |
| Wolfi | jaeger-2-jaeger | 2.17.0-r7 |
| Wolfi | k8sgpt | 0.4.36-r1 |
| Wolfi | k8sgpt | 0.4.38-r3 |
| Wolfi | karma | 0.129-r2 |
| Wolfi | keda-2.19 | 2.19.0-r15 |
| Wolfi | keda-2.19-metrics-apiserver | 2.19.0-r15 |
| Wolfi | loki-3.6 | 3.6.12-r0 |
| Wolfi | loki-3.6-logcli | 3.6.12-r0 |
| Wolfi | loki-3.6-loki-canary | 3.6.12-r0 |
| Wolfi | loki-3.6-promtail | 3.6.12-r0 |
| Wolfi | loki-3.7 | 3.7.2-r1 |
| Wolfi | loki-3.7-logcli | 3.7.2-r1 |
| Wolfi | loki-3.7-loki-canary | 3.7.2-r1 |
| Wolfi | mc | 0.20250813.083541-r11 |
| Wolfi | mcp-grafana | 0.13.1-r1 |
| Wolfi | metrics-server | 0.8.1-r8 |
| Wolfi | minio | 0.20260512.133534-r0 |
| Wolfi | minio-object-browser | 2.0.4-r14 |
| Wolfi | minio-operator | 7.1.1-r28 |
| Wolfi | minio-operator-compat | 7.1.1-r33 |
| Wolfi | minio-operator-sidecar | 7.1.1-r28 |
| Wolfi | node-problem-detector-1.35 | 1.35.2-r12 |
| Wolfi | opentelemetry-collector | 0.152.1-r0 |
| Wolfi | opentelemetry-collector-contrib | 0.152.0-r0 |
| Wolfi | opentelemetry-operator-otel-allocator | 0.150.0-r1 |
| Wolfi | prometheus-3.10 | no fix |
| Wolfi | prometheus-3.8 | no fix |
| Wolfi | prometheus-3.9 | no fix |
| Wolfi | prometheus-pushgateway | 1.11.2-r10 |
| Wolfi | splunk-otel-collector | 0.152.0-r0 |
| Wolfi | telegraf-1.36 | no fix |
| Wolfi | telegraf-1.37 | no fix |
| Wolfi | telegraf-1.38 | 1.38.3-r3 |
| Wolfi | tempo-2.10 | 2.10.6-r0 |
| Wolfi | tempo-2.10-cli | 2.10.6-r0 |
| Wolfi | tempo-2.10-vulture | 2.10.6-r0 |
| Wolfi | thanos | no fix |
| Wolfi | trillian-logserver | 1.7.3-r5 |
| Wolfi | trillian-logsigner | 1.7.3-r5 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |