Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Apr 2026Clear ×Project: PrometheusClear ×

Prometheusv3.11.3ObservabilityApr 27, 2026

CHECK 3View full analysis

A security maintenance release with corrections for credential exposure, request decoding validation, and stored cross-site scripting. Advisory identifiers are provided for the addressed defects, and the fixes ship in this release.

Check if affected (3)

securityhighAzureAD remote write OAuth client_secret exposure fix
Applies if you use AzureAD remote write.
In v3.11.3, OAuth client_secret is no longer exposed in plaintext through the /-/config endpoint for AzureAD remote write. This addresses GHSA-wg65-39gg-5wfj and CVE-2026-42151.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
In v3.11.3, Remote-read rejects snappy-compressed requests whose declared decoded length exceeds the decode limit. This addresses GHSA-8rm2-7qqf-34qm and CVE-2026-42154.
securitymediumOld UI heatmap chart le label escaping
Applies if you use the old UI heatmap chart.
In v3.11.3, the old UI heatmap chart escapes le label values in tick labels to fix stored XSS. This addresses GHSA-fw8g-cg8f-9j28.

Source ↗

Prometheusv3.5.3ObservabilityApr 27, 2026

CHECK 4View full analysis

A security-focused release with fixes for exposed OAuth secrets and stored XSS. Remote read and write request validation now rejects snappy-compressed payloads whose declared decoded length exceeds the decode limit.

Check if affected (4)

securityhighAzureAD remote write client_secret exposure fixed
Applies if you use AzureAD remote write.
AzureAD remote write no longer exposes the OAuth client_secret in plaintext through the /-/config endpoint. The fix ships with CVE-2026-42151 and GHSA-wg65-39gg-5wfj.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
Remote-read now rejects snappy-compressed requests whose declared decoded length exceeds the decode limit. The fix ships with CVE-2026-42154 and GHSA-8rm2-7qqf-34qm.
securitymediumOld UI heatmap chart le label escaping
Applies if you use UI.
The old UI heatmap chart no longer permits stored XSS through unescaped le label values in chart tick labels. The fix ships with GHSA-fw8g-cg8f-9j28.
+ 1 more on the release page

Source ↗

Prometheusv3.11.2ObservabilityApr 13, 2026

CHECK 1OTHER 2View full analysis

Release v3.11.2 fixes stored XSS in the Prometheus web UI and changes Consul service-discovery filtering. The Consul updates add health_filter support and correct how filter parameters are applied to the Health API.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI, CVE-2026-40179
Applies if you use the Prometheus web UI.
The Prometheus web UI now escapes metric names and labels, fixing stored XSS via unescaped values. This fix ships in v3.11.2 and addresses CVE-2026-40179.

Source ↗

Prometheusv3.5.2ObservabilityApr 13, 2026

CHECK 1OTHER 1View full analysis

Prometheus v3.5.2 fixes a stored XSS vulnerability in the Prometheus web UI. The release also includes a regex performance improvement.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI
Applies if crafted metric names or label values can reach the Prometheus web UI.
The Prometheus web UI fixes stored XSS through escaped handling of metric names and label values in tooltips and the metrics explorer. The fix is tracked as CVE-2026-40179.

Source ↗

Browse by month