Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: PrometheusClear ×

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
Credentials, including the Authorization header, basic authentication, bearer tokens, OAuth2 credentials, and configured headers, are no longer forwarded when following a redirect to a different host. The behavior ships via prometheus/common v0.69.0 and addresses CVE-2025-4673 and CVE-2023-45289.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().
The experimental PromQL duration-expression functions min() and max() are renamed to min_of() and max_of() to distinguish them from the min and max aggregate operators.

Source ↗

Prometheusv3.5.4ObservabilityJun 17, 2026

ACTION 2CHECK 1OTHER 1View full analysis

Prometheus v3.5.4 is primarily a security maintenance release, with a fix for plaintext secret exposure and dependency updates addressing reported advisories. It also adds publication of container images to the GitHub Container Registry at ghcr.io.

Action needed (2)

securitycriticalgolang.org/x/net and OpenTelemetry dependency updates
The golang.org/x/net dependency is updated to v0.55.0, and OpenTelemetry to v1.43.0. These updates address reported advisories GO-2026-5026, GO-2026-4918, and GO-2026-4985.
securityPatched UI dependency versions
The UI dependencies react-router-dom, vitest, vite, and postcss are updated to patched versions to resolve security advisories.

Check if affected (1)

securityPlaintext secret exposure via /-/config corrected
Applies if you access the /-/config endpoint.
The /-/config endpoint no longer exposes secrets in plaintext. This fix addresses advisory GHSA-39j6-789q-qxvh.

Source ↗

Prometheusv3.12.0ObservabilityMay 28, 2026

ACTION 1CHECK 3OTHER 45View full analysis

A feature and maintenance release with new operator-facing APIs, discovery integrations, feature flags, configuration options, and UI capabilities. It also addresses disclosed security issues, correctness and performance problems, and validation or constraint behavior.

Action needed (1)

breakingConcurrent fgprof profile rejection
The API rejects concurrent fgprof profiles.

Check if affected (3)

securityRemote Write decoded-length constraint
Applies if you use Remote Write.
Remote Write rejects snappy-compressed received requests whose declared decoded length exceeds 32MB.
securityPlaintext secret exposure in STACKIT SD
Applies if you use STACKIT SD.
STACKIT SD no longer exposes secrets in plaintext through the /-/config endpoint. This fix addresses GHSA-39j6-789q-qxvh.
breakingDecompressed body-size limit for OTLP write requests
Applies if you use OTLP.
OTLP limits the decompressed body size for gzip-encoded write requests.

Source ↗

Prometheusv3.11.3ObservabilityApr 27, 2026

CHECK 3View full analysis

A security maintenance release with corrections for credential exposure, request decoding validation, and stored cross-site scripting. Advisory identifiers are provided for the addressed defects, and the fixes ship in this release.

Check if affected (3)

securityhighAzureAD remote write OAuth client_secret exposure fix
Applies if you use AzureAD remote write.
In v3.11.3, OAuth client_secret is no longer exposed in plaintext through the /-/config endpoint for AzureAD remote write. This addresses GHSA-wg65-39gg-5wfj and CVE-2026-42151.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
In v3.11.3, Remote-read rejects snappy-compressed requests whose declared decoded length exceeds the decode limit. This addresses GHSA-8rm2-7qqf-34qm and CVE-2026-42154.
securitymediumOld UI heatmap chart le label escaping
Applies if you use the old UI heatmap chart.
In v3.11.3, the old UI heatmap chart escapes le label values in tick labels to fix stored XSS. This addresses GHSA-fw8g-cg8f-9j28.

Source ↗

Prometheusv3.5.3ObservabilityApr 27, 2026

CHECK 4View full analysis

A security-focused release with fixes for exposed OAuth secrets and stored XSS. Remote read and write request validation now rejects snappy-compressed payloads whose declared decoded length exceeds the decode limit.

Check if affected (4)

securityhighAzureAD remote write client_secret exposure fixed
Applies if you use AzureAD remote write.
AzureAD remote write no longer exposes the OAuth client_secret in plaintext through the /-/config endpoint. The fix ships with CVE-2026-42151 and GHSA-wg65-39gg-5wfj.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
Remote-read now rejects snappy-compressed requests whose declared decoded length exceeds the decode limit. The fix ships with CVE-2026-42154 and GHSA-8rm2-7qqf-34qm.
securitymediumOld UI heatmap chart le label escaping
Applies if you use UI.
The old UI heatmap chart no longer permits stored XSS through unescaped le label values in chart tick labels. The fix ships with GHSA-fw8g-cg8f-9j28.
+ 1 more on the release page

Source ↗

Prometheusv3.11.2ObservabilityApr 13, 2026

CHECK 1OTHER 2View full analysis

Release v3.11.2 fixes stored XSS in the Prometheus web UI and changes Consul service-discovery filtering. The Consul updates add health_filter support and correct how filter parameters are applied to the Health API.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI, CVE-2026-40179
Applies if you use the Prometheus web UI.
The Prometheus web UI now escapes metric names and labels, fixing stored XSS via unescaped values. This fix ships in v3.11.2 and addresses CVE-2026-40179.

Source ↗

Prometheusv3.5.2ObservabilityApr 13, 2026

CHECK 1OTHER 1View full analysis

Prometheus v3.5.2 fixes a stored XSS vulnerability in the Prometheus web UI. The release also includes a regex performance improvement.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI
Applies if crafted metric names or label values can reach the Prometheus web UI.
The Prometheus web UI fixes stored XSS through escaped handling of metric names and label values in tooltips and the metrics explorer. The fix is tracked as CVE-2026-40179.

Source ↗

Browse by month