Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
CVSS Details
- CVSS 3.1 Base Score: 6.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade prometheusUpgrade prometheus-node-exporter | Aug 22, 2024 | Nov 29, 2022 |
| Debian | — | Upgrade golang-github-prometheus-exporter-toolkit | Jul 30, 2024 | Nov 29, 2022 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Freebsd | — | Upgrade prometheusUpgrade node_exporter | Feb 4, 2023 | Feb 4, 2023 |
| Gentoo Linux | — | Upgrade app-metrics/snmp_exporter. | Jan 15, 2024 | Nov 29, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 29, 2022 |
| Suse | — | Upgrade prometheus-postgres_exporterUpgrade golang-github-prometheus-promuUpgrade golang-github-qubitproducts-exporter_exporterUpgrade supportutils-plugin-susemanager-clientUpgrade libirs1601-32bitUpgrade bind-devel-32bitUpgrade bindUpgrade bind-docUpgrade firewalld-prometheus-configUpgrade libbind9-1600Upgrade prometheus-ha_cluster_exporterUpgrade libisccfg1600-32bitUpgrade libdns1605-32bitUpgrade grafanaUpgrade libns1604-32bitUpgrade libirs-develUpgrade bind-develUpgrade bind-chrootenvUpgrade libirs1601Upgrade python3-bindUpgrade libisccfg1600Upgrade bind-utilsUpgrade libisc1606-32bitUpgrade prometheus-blackbox_exporterUpgrade golang-github-lusitaniae-apache_exporterUpgrade libdns1605Upgrade libns1604Upgrade golang-github-prometheus-node_exporterUpgrade libbind9-1600-32bitUpgrade dracut-saltbootUpgrade golang-github-prometheus-prometheusUpgrade libisc1606Upgrade spacecmdUpgrade wireUpgrade supportutils-plugin-saltUpgrade golang-github-prometheus-alertmanagerUpgrade libisccc1600Upgrade libisccc1600-32bit | Feb 21, 2023 | Nov 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub