Prometheus 3.11.0 → 3.11.3

3 releases · 0 breaking changes · 7 security fixes · 2 advisories fixed

7security0breaking0deprecated1feature2fix

Is 3.11.0 affected? · What changed up to 3.15.1

Vulnerabilities fixed by this upgrade

7.5 CVE-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API
7.5 CVE-2026-42154 Remote read endpoint allows denial of service via crafted snappy payload

Breaking changes

None in the release notes.

Security changes

security Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability. in 3.11.3
security Brett Gervasoni for the AzureAD OAuth client_secret vulnerability. in 3.11.3
security @iiihaiii and @Ngocnn97 for the Old UI XSS vulnerability. in 3.11.3
security [SECURITY] AzureAD remote write: Fix OAuth client_secret being exposed in plaintext via /-/config endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 #18590 in 3.11.3
security [SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 #18584 in 3.11.3
security [SECURITY] UI: Fix stored XSS via unescaped le label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 #18588 in 3.11.3
security [SECURITY] UI: Fix stored XSS via unescaped metric names and labels. CVE-2026-40179. #18506 in 3.11.2

Every release in between

3.11.3 Apr 27, 2026 Release notes ↗

securityShadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

securityBrett Gervasoni for the AzureAD OAuth client_secret vulnerability.

security@iiihaiii and @Ngocnn97 for the Old UI XSS vulnerability.

security[SECURITY] AzureAD remote write: Fix OAuth client_secret being exposed in plaintext via /-/config endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 #18590

security[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 #18584

security[SECURITY] UI: Fix stored XSS via unescaped le label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 #18588

3.11.2 Apr 13, 2026 Release notes ↗

security[SECURITY] UI: Fix stored XSS via unescaped metric names and labels. CVE-2026-40179. #18506

feature[ENHANCEMENT] Consul SD: Introduce health_filter field for Health API filtering. #18499

fix[BUGFIX] Consul SD: Fix filter parameter being incorrectly applied to the Health API. #18499

3.11.1 Apr 7, 2026 Release notes ↗

fix[BUGFIX] Tracing: Fix startup failure for OTLP HTTP tracing with insecure: true. #18469