CVE-2019-3826

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

• CWE-79
• CWE-79

• https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
• https://advisory.checkmarx.net/advisory/CX-2019-4297
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3826Issue Tracking, Patch, Third Party Advisory
• https://github.com/prometheus/prometheus/commit/62e591f9Patch, Third Party Advisory
• https://github.com/prometheus/prometheus/pull/5163Patch, Third Party Advisory
• https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E
• https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
• https://advisory.checkmarx.net/advisory/CX-2019-4297
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3826Issue Tracking, Patch, Third Party Advisory
• https://github.com/prometheus/prometheus/commit/62e591f9Patch, Third Party Advisory
• https://github.com/prometheus/prometheus/pull/5163Patch, Third Party Advisory
• https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E

Published

Mar 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3820It was discovered that the gnome-shell lock screen since ver…4.3
• CVE-2019-3821A flaw was found in the way civetweb frontend was handling r…7.5
• CVE-2019-3822libcurl versions from 7.36.0 to before 7.64.0 are vulnerable…9.8
• CVE-2019-3823libcurl versions from 7.34.0 to before 7.64.0 are vulnerable…4.3
• CVE-2019-3824A flaw was found in the way an LDAP search expression could …
• CVE-2019-3825A vulnerability was discovered in gdm before 3.31.4. When ti…6.3
• CVE-2019-3827An incorrect permission check in the admin backend in gvfs b…7
• CVE-2019-3828Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 h…4.2
• CVE-2019-3829A vulnerability was found in gnutls versions from 3.5.8 befo…5.3
• CVE-2019-3830A vulnerability was found in ceilometer before version 12.0.…7.8
• CVE-2019-3831A vulnerability was discovered in vdsm, version 4.19 through…6.7
• CVE-2019-3832It was discovered the fix for CVE-2018-19758 (libsndfile) wa…5.5