Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Apr 2026Clear ×Project: PrometheusClear ×

Prometheusv3.11.3ObservabilityApr 27, 2026

CHECK 3View full analysis

A security maintenance release with corrections for credential exposure, request decoding validation, and stored cross-site scripting. Advisory identifiers are provided for the addressed defects, and the fixes ship in this release.

Check if affected (3)

securityhighAzureAD remote write OAuth client_secret exposure fix
Applies if you use AzureAD remote write.
In v3.11.3, OAuth client_secret is no longer exposed in plaintext through the /-/config endpoint for AzureAD remote write. This addresses GHSA-wg65-39gg-5wfj and CVE-2026-42151.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
In v3.11.3, Remote-read rejects snappy-compressed requests whose declared decoded length exceeds the decode limit. This addresses GHSA-8rm2-7qqf-34qm and CVE-2026-42154.
securitymediumOld UI heatmap chart le label escaping
Applies if you use the old UI heatmap chart.
In v3.11.3, the old UI heatmap chart escapes le label values in tick labels to fix stored XSS. This addresses GHSA-fw8g-cg8f-9j28.

Source ↗

Prometheusv3.5.3ObservabilityApr 27, 2026

CHECK 4View full analysis

A security-focused release with fixes for exposed OAuth secrets and stored XSS. Remote read and write request validation now rejects snappy-compressed payloads whose declared decoded length exceeds the decode limit.

Check if affected (4)

securityhighAzureAD remote write client_secret exposure fixed
Applies if you use AzureAD remote write.
AzureAD remote write no longer exposes the OAuth client_secret in plaintext through the /-/config endpoint. The fix ships with CVE-2026-42151 and GHSA-wg65-39gg-5wfj.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
Remote-read now rejects snappy-compressed requests whose declared decoded length exceeds the decode limit. The fix ships with CVE-2026-42154 and GHSA-8rm2-7qqf-34qm.
securitymediumOld UI heatmap chart le label escaping
Applies if you use UI.
The old UI heatmap chart no longer permits stored XSS through unescaped le label values in chart tick labels. The fix ships with GHSA-fw8g-cg8f-9j28.
+ 1 more on the release page

Source ↗

Prometheusv3.11.2ObservabilityApr 13, 2026

CHECK 1OTHER 2View full analysis

Release v3.11.2 fixes stored XSS in the Prometheus web UI and changes Consul service-discovery filtering. The Consul updates add health_filter support and correct how filter parameters are applied to the Health API.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI, CVE-2026-40179
Applies if you use the Prometheus web UI.
The Prometheus web UI now escapes metric names and labels, fixing stored XSS via unescaped values. This fix ships in v3.11.2 and addresses CVE-2026-40179.

Source ↗

Prometheusv3.5.2ObservabilityApr 13, 2026

CHECK 1OTHER 1View full analysis

Prometheus v3.5.2 fixes a stored XSS vulnerability in the Prometheus web UI. The release also includes a regex performance improvement.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI
Applies if crafted metric names or label values can reach the Prometheus web UI.
The Prometheus web UI fixes stored XSS through escaped handling of metric names and label values in tooltips and the metrics explorer. The fix is tracked as CVE-2026-40179.

Source ↗

Prometheusv3.11.1ObservabilityApr 7, 2026

OTHER 1View full analysis

This release includes an operator-facing bug fix for OTLP HTTP tracing when insecure: true is used. No change entry is displayed here.

Source ↗

Prometheusv3.11.0ObservabilityApr 2, 2026

CHECK 1PLAN 2OTHER 42View full analysis

A broad release with new service discovery, PromQL, TSDB, and UI capabilities, alongside performance, dependency, output, and correctness changes. It also deprecates legacy Hetzner discovery labels and corrects TSDB retention-time handling.

Check if affected (1)

breakingThe storage.tsdb.retention.time unit handling
Applies if you configure storage.tsdb.retention.time.
TSDB fixes the unit mismatch in storage.tsdb.retention.time that could make retention 1e6 times longer than configured.

Plan ahead (2)

deprecatedThe __meta_hetzner_datacenter label, deprecatedremoval date not announced
Applies if you use __meta_hetzner_datacenter.
The __meta_hetzner_datacenter label is deprecated for the robot role but remains available for backward compatibility. For the hcloud role, it will stop working after 1 July 2026; __meta_hetzner_robot_datacenter is the replacement for robot.
deprecatedThe Hetzner Cloud datacenter location labels, deprecated
Applies if you use __meta_hetzner_hcloud_datacenter_location or __meta_hetzner_hcloud_datacenter_location_network_zone.
The __meta_hetzner_hcloud_datacenter_location and __meta_hetzner_hcloud_datacenter_location_network_zone labels are deprecated. They are replaced by __meta_hetzner_hcloud_location and __meta_hetzner_hcloud_location_network_zone.

Source ↗

Browse by month