Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade prometheus | Aug 22, 2024 | May 19, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 19, 2021 |
| Freebsd | — | Upgrade prometheus2 | Nov 4, 2022 | Jun 1, 2021 |
| Suse | — | Upgrade python3-mgr-osa-dispatcherUpgrade mgr-virtualization-hostUpgrade golang-github-prometheus-prometheusUpgrade mgr-pushUpgrade ansible-docUpgrade python3-suseregisterinfoUpgrade python2-mgr-osadUpgrade spacewalk-koanUpgrade python2-mgr-cfg-actionsUpgrade mgr-cfg-managementUpgrade python2-mgr-cfg-clientUpgrade python2-mgr-cfgUpgrade python3-mgr-cfg-actionsUpgrade python3-mgr-virtualization-commonUpgrade spacewalk-client-toolsUpgrade python3-uyuni-common-libsUpgrade mgr-cfg-clientUpgrade python3-spacewalk-checkUpgrade python2-mgr-cfg-managementUpgrade python3-spacewalk-client-toolsUpgrade python2-spacewalk-checkUpgrade python2-mgr-osa-dispatcherUpgrade spacewalk-client-setupUpgrade python3-spacewalk-oscapUpgrade python3-spacewalk-koanUpgrade python3-mgr-cfg-managementUpgrade spacewalk-oscapUpgrade python3-spacewalk-client-setupUpgrade python2-mgr-osa-commonUpgrade python2-spacewalk-client-toolsUpgrade ansible-testUpgrade python3-mgr-pushUpgrade ansibleUpgrade mgr-osa-dispatcherUpgrade python2-suseregisterinfoUpgrade python2-mgr-pushUpgrade python3-mgr-cfgUpgrade python2-mgr-virtualization-hostUpgrade suseregisterinfoUpgrade python3-mgr-osa-commonUpgrade mgr-cfg-actionsUpgrade python3-mgr-osadUpgrade python3-rhnlibUpgrade python2-spacewalk-oscapUpgrade dracut-saltbootUpgrade python2-mgr-virtualization-commonUpgrade python3-mgr-cfg-clientUpgrade python2-rhnlibUpgrade python2-uyuni-common-libsUpgrade mgr-cfgUpgrade spacecmdUpgrade mgr-custom-infoUpgrade python2-spacewalk-koanUpgrade mgr-osadUpgrade python3-mgr-virtualization-hostUpgrade python2-spacewalk-client-setupUpgrade spacewalk-check | Aug 13, 2021 | May 19, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub