CVE-2026-44903

What it actually does

CVE-2026-44903 is a stored or reflected cross-site scripting weakness in the Prometheus server legacy web UI when the old UI is enabled with `--enable-feature=old-ui`. In affected Prometheus versions from 2.49.0 up to, but not including, 3.5.3 and 3.11.3, the histogram heatmap chart inserts metric label values into generated HTML for axis tick labels without proper escaping. An attacker with the ability to publish, scrape, federate, or otherwise inject crafted metrics into Prometheus can place JavaScript-bearing label values into time series data. When an authenticated or otherwise authorized Prometheus user views the affected metric in the heatmap chart, the browser executes the attacker-controlled script in the Prometheus UI origin. The flaw does not directly compromise the Prometheus server process, but it can compromise user sessions, alter UI-rendered data, perform actions available to the victim in the Prometheus web interface, or pivot through browser-accessible internal resources depending on deployment and browser protections.

Why it matters to the business

Successful exploitation can undermine trust in monitoring data and expose users who operate or investigate Prometheus dashboards to browser-based compromise. An attacker who can influence scraped metrics, such as through a compromised application, exporter, service discovery target, or metrics ingestion path, may use the monitoring system as a delivery mechanism to execute code in an operator's browser. Operational consequences include misleading incident responders, stealing sensitive information visible in the UI, triggering unauthorized UI actions, and creating a foothold for broader internal reconnaissance. The vulnerability has a moderate CVSS score of 6.1, very low current EPSS probability, is not listed in CISA KEV, and has no reported ransomware use, so urgency is highest for environments that enable the legacy UI and ingest metrics from untrusted or semi-trusted sources.

How an attack unfolds

An attacker first obtains a path to influence metrics that Prometheus scrapes or ingests. This could be by compromising an application that exposes a `/metrics` endpoint, controlling a custom exporter, abusing a multi-tenant metrics source, or introducing a malicious target into a monitored environment. The attacker then crafts a histogram metric with a label value containing HTML or JavaScript payload syntax intended to execute when rendered. In affected versions with `--enable-feature=old-ui`, Prometheus stores or serves the malicious time series normally because the payload is embedded in label data rather than executable server-side code. The attacker then waits for or persuades a Prometheus user to open the legacy web UI and inspect the affected histogram using the heatmap chart view. When the heatmap renders axis tick mark labels, the UI fails to escape the label value and injects it into HTML, causing the browser to execute the payload in the context of the Prometheus web interface. The payload can then read page content, manipulate the UI, issue same-origin requests permitted by the victim's session, or attempt to exfiltrate data to attacker-controlled infrastructure if network egress and content security controls allow it.

How to fix it

Upgrade Prometheus to a fixed release: 3.5.3 or later on the 3.5.x line, or 3.11.3 or later on the 3.11.x line. If upgrading immediately is not possible, disable the legacy web UI by removing `--enable-feature=old-ui` from Prometheus startup arguments. Restrict access to the Prometheus web UI to trusted administrators through network controls, authentication proxies, VPNs, or zero-trust access controls. Treat metrics ingestion as an input boundary: avoid scraping untrusted endpoints, validate service discovery sources, limit who can register scrape targets, and isolate multi-tenant or externally influenced metrics. Consider placing egress controls and browser security controls around administrative workstations to reduce the impact of JavaScript execution. Do not rely on label sanitization in exporters alone as the primary fix; the vulnerable UI behavior should be removed by upgrade or by disabling the old UI.

How to confirm the fix worked

Confirm the running Prometheus version is not in the affected range and is at least 3.5.3 or 3.11.3, depending on the release line. Review the Prometheus process arguments, service unit, container command, Helm values, or deployment manifest and verify that `--enable-feature=old-ui` is absent unless a fixed version is deployed. Validate externally by accessing the Prometheus UI and confirming the legacy old UI is not available on vulnerable builds. Inventory scrape targets and exporters to identify any source where an untrusted party can control metric names or label values. As a safe functional test in a non-production environment, inject a benign label containing escaped HTML-like text and confirm it is displayed as inert text rather than interpreted markup in the heatmap chart. Check release notes and package metadata to ensure the deployed binary actually corresponds to the fixed Prometheus release and that stale containers or sidecar images are not still running older versions.

Typical attack path

1. Identify a Prometheus deployment running an affected version with the legacy old UI enabled.
2. Gain the ability to influence metrics ingested by Prometheus through a scraped application, exporter, federation source, service discovery target, or compromised metrics endpoint.
3. Create or modify a histogram metric so that a label value contains an HTML or JavaScript payload.
4. Ensure Prometheus scrapes or receives the malicious metric series.
5. Wait for or socially engineer a Prometheus user to open the legacy UI heatmap chart for the affected metric.
6. Have the victim browser render the unescaped label value and execute the injected JavaScript.
7. Use the script to access UI-visible information, perform victim-authorized actions, alter what the user sees, or attempt further browser-based pivoting or exfiltration.

How to detect it

To determine whether this was already exploited, focus on evidence that malicious label values entered Prometheus and were later rendered through the legacy heatmap UI. Review Prometheus server access logs, reverse proxy logs, ingress logs, and authentication proxy logs for requests to the old UI and heatmap-related pages around the time suspicious metrics were present. Inspect scraped metrics from exporters, application `/metrics` endpoints, remote write sources, and federation sources for label values containing HTML tags, event handlers, script blocks, JavaScript URLs, encoded markup, or common XSS payload fragments. Query Prometheus for unusual label values on histogram metrics, especially labels containing characters such as `<`, `>`, quotes, backticks, `javascript:`, `onerror=`, `onload=`, or `<svg`. Examine configuration and service discovery changes to determine whether new or unexpected scrape targets appeared before suspicious UI activity. Correlate Prometheus UI access by operators with browser, EDR, DNS, proxy, and firewall telemetry for outbound connections to unusual domains or IPs shortly after heatmap views were accessed. Because XSS payloads may execute only in the victim browser and may not leave server-side errors, absence of Prometheus server errors does not rule out exploitation.

• --enable-feature=old-ui
• <script
• </script>
• javascript:
• onerror=
• onload=
• onmouseover=
• onclick=
• <img
• <svg
• <iframe
• document.cookie
• document.domain
• localStorage
• sessionStorage
• fetch(
• XMLHttpRequest
• eval(
• atob(
• String.fromCharCode
• `<script
• %3Cscript
• %3C%2Fscript%3E
• %3Csvg
• %3Cimg
• /metrics
• /graph
• /classic/graph
• /classic

What your security team should do

• Prioritize remediation for any Prometheus server running versions 2.49.0 through versions before 3.5.3 or before 3.11.3 where `--enable-feature=old-ui` is enabled.
• Upgrade Prometheus to 3.5.3, 3.11.3, or a later fixed release; if change windows delay patching, immediately disable the old UI feature flag.
• Restrict Prometheus UI access to authorized operational users and avoid exposing it directly to broad internal networks or the internet.
• Audit metrics ingestion paths for untrusted exporters, compromised applications, federation sources, and service discovery mechanisms that could introduce malicious label values.
• Search recent metrics, exporter output, and Prometheus access logs for HTML or JavaScript-like strings in metric label values and queries involving heatmap chart views.
• Review administrative browser telemetry, proxy logs, and DNS logs for suspicious outbound connections occurring after users accessed Prometheus heatmap views.
• Educate monitoring operators not to open suspicious metrics or externally supplied Prometheus links until affected instances are patched or the old UI is disabled.