CVE-2026-40179

Medium

Advisory

Published 13 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.003; 18th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 258; of 17,781 indexed, latest versions
Container images: 258; deployed by those charts
Fix available: 2 of 2; affected packages

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Carried by container images the latest versions of 258 of 17,781 indexed charts deploy, on 258 images.

Affected package	Affected versions	Fixed in	Images
github.com/prometheus/prometheusgolang	v0.0.0-20200213233353-b90be6f32a33, v0.0.0-20200326161412-ae041f97cfc6, v0.0.0-20200609090129-a6600f564e3c, v0.0.0-20220620125440-d7e7b8e04b5e+89 more	0.311.2-0.20260410083055-07c6232d159b	258
prometheusbitnami	2.54.1-2	0.305.2	1

OSV records: BIT-prometheus-2026-40179 GHSA-vffh-x6r8-xx99
Also known as: GO-2026-5662

Charts affected

258 by stars

Chart

Latest

Affected images

Radar Score

truefoundry-monitoringtruefoundry

0.1.6

2 of 8 See more

truefoundry-monitoring truefoundry 0.1.6

2 of the 8 container images this version deploys carry CVE-2026-40179.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.0	70d9599b186c	github.com/prometheus/prometheus@v0.303.1	0.311.2-0.20260410083055-07c6232d159b
quay.io/prometheus-operator/prometheus-operator :v0.88.0	b4f51de53357	github.com/prometheus/prometheus@v0.309.1	0.311.2-0.20260410083055-07c6232d159b

Open the chart page →

4,526

opencloudunxwares

0.2.3

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-40179.

Container image	Digest	Package	Fixed in
minio/minio :latest	14cea493d9a3	github.com/prometheus/prometheus@v0.303.0	0.311.2-0.20260410083055-07c6232d159b

Open the chart page →

45,239

prometheus-storage-adapterwavefront

0.1.6

1 of 2 See more

prometheus-storage-adapter wavefront 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-40179.

Container image	Digest	Package	Fixed in
wavefronthq/prometheus-storage-adapter :latest	ded77b38c7c6	github.com/prometheus/prometheus@v0.0.0-20200213233353-b90be6f32a33	0.311.2-0.20260410083055-07c6232d159b

Open the chart page →

1,278

istio-service-meshwbstack

0.0.1

1 of 1 See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-40179.

Container image	Digest	Package	Fixed in
istio/pilot :1.17.1	ce9d87606701	github.com/prometheus/prometheus@v0.36.2	0.311.2-0.20260410083055-07c6232d159b

Open the chart page →

6,232

prometheuswenerme

29.29.0

1 of 6 See more

prometheus wenerme 29.29.0

1 of the 6 container images this version deploys carry CVE-2026-40179.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v3.14.0	5ce7540c3c00	github.com/prometheus/prometheus@v0.0.0-20260817133844-d7598b714141+dirty	0.311.2-0.20260410083055-07c6232d159b

Open the chart page →

458

opentelemetry-collectorwikimedia

0.62.7

1 of 1 See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-40179.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	github.com/prometheus/prometheus@v0.43.1	0.311.2-0.20260410083055-07c6232d159b

Open the chart page →

2,022

ygdrassil-monitoringygdrassil

0.4.0

4 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

4 of the 10 container images this version deploys carry CVE-2026-40179.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	github.com/prometheus/prometheus@v0.52.0	0.311.2-0.20260410083055-07c6232d159b
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	github.com/prometheus/prometheus@v0.300.1	0.311.2-0.20260410083055-07c6232d159b
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	github.com/prometheus/prometheus@v0.0.0-20250102134959-7086161a93b2	0.311.2-0.20260410083055-07c6232d159b
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	github.com/prometheus/prometheus@v0.301.0	0.311.2-0.20260410083055-07c6232d159b

Open the chart page →

9,381

prometheus-monitoring-stackyotron-helm-charts

1.2.0

1 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-40179.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :latest	5ce7540c3c00	github.com/prometheus/prometheus@v0.0.0-20260817133844-d7598b714141+dirty	0.311.2-0.20260410083055-07c6232d159b

Open the chart page →

878

Container images carrying it

258 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/prometheus/prometheus :v2.53.1	f20d3127bf28	github.com/prometheus/prometheus@v0.0.0-20240710101407-14cfec3f6048	0.311.2-0.20260410083055-07c6232d159b	1
quay.io/prometheus/pushgateway :v1.11.1	03738d278e08	github.com/prometheus/prometheus@v0.302.1	0.311.2-0.20260410083055-07c6232d159b	1
quay.io/thanos/thanos :v0.40.1	aae7b2b030ed	github.com/prometheus/prometheus@v0.305.1-0.20250721065454-b09cf6be8d56	0.311.2-0.20260410083055-07c6232d159b	1
quay.io/thanos/thanos :v0.36.1	e542959e1b36	github.com/prometheus/prometheus@v0.52.2-0.20240614130246-4c1e71fa0b3d	0.311.2-0.20260410083055-07c6232d159b	1
registry.k8s.io/metrics-server/metrics-server :v0.7.0	1c0419326500	github.com/prometheus/prometheus@v0.48.1	0.311.2-0.20260410083055-07c6232d159b	1
registry.k8s.io/metrics-server/metrics-server :v0.7.1	db3800085a09	github.com/prometheus/prometheus@v0.48.1	0.311.2-0.20260410083055-07c6232d159b	1
registry.k8s.io/node-problem-detector/node-problem-detector :v0.8.20	52f0618e9bc2	github.com/prometheus/prometheus@v0.35.0	0.311.2-0.20260410083055-07c6232d159b	1
registry.k8s.io/node-problem-detector/node-problem-detector :v1.35.1	c380751accc5	github.com/prometheus/prometheus@v0.35.0	0.311.2-0.20260410083055-07c6232d159b	1