CVE-2021-29622

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

• CWE-601

• https://github.com/prometheus/prometheus/releases/tag/v2.26.1Third Party Advisory
• https://github.com/prometheus/prometheus/releases/tag/v2.27.1Third Party Advisory
• https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7Third Party Advisory
• https://github.com/prometheus/prometheus/releases/tag/v2.26.1Third Party Advisory
• https://github.com/prometheus/prometheus/releases/tag/v2.27.1Third Party Advisory
• https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7Third Party Advisory

Published

May 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29616TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-29617TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-29618TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-29619TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-29620Report portal is an open source reporting and analysis frame…7.5
• CVE-2021-29621Flask-AppBuilder is a development framework, built on top of…5.3
• CVE-2021-29623Exiv2 is a C++ library and a command-line utility to read, w…3.3
• CVE-2021-29624fastify-csrf is an open-source plugin helps developers prote…6.5
• CVE-2021-29625Adminer is open-source database management software. A cross…6.1
• CVE-2021-29626In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r3…5.5
• CVE-2021-29627In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r3…7.8
• CVE-2021-29628In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STA…7.5