Prometheus Vulnerable to Basic Authentication Bypass
Summary
GHSA-4v48-4q5m-8vx4: Prometheus vulnerable to basic authentication bypass. Affects github.com/prometheus/prometheus across 2 version ranges.
>= 2.24.1, < 2.37.4
>= 2.38.0, < 2.40.4
Fixed in 2.37.4 or 2.40.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Prometheus is an open-source monitoring and alerting toolkit designed for large-scale distributed systems. It collects metrics from configured targets, stores them, and provides a query language to analyze and visualize the data. The toolkit is written in Go and widely used in various industries to monitor and manage their systems. However, a vulnerability has been discovered in Prometheus that allows for basic authentication bypass.
Vulnerability Detail
The vulnerability in Prometheus lies in the way basic authentication is implemented using the exporter toolkit. While passwords are hashed with bcrypt, making it difficult to retrieve the original password, a flaw in the implementation allows attackers with knowledge of the hashed password to forge a request and poison the internal cache used for hash computation. This enables them to bypass authentication and gain unauthorized access to Prometheus. The cache is used to limit side-channel attacks and is utilized in both successful and unsuccessful authentication scenarios.
How To Fix
Latest published version: v0.315.1 as of 23 Oct 2026
go get github.com/prometheus/prometheus@v0.315.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.24.1, < 2.37.42.37.4go get github.com/prometheus/prometheus@v2.37.4 -
>= 2.38.0, < 2.40.42.40.4go get github.com/prometheus/prometheus@v2.40.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround for this vulnerability. However, it is important to ensure that the hashed passwords stored on disk are adequately protected. Access to the hashed passwords should be restricted to authorized personnel only.
Conclusion
Prometheus is vulnerable to a basic authentication bypass, which can be exploited by attackers with knowledge of the hashed password. It is crucial to update Prometheus to versions 2.37.4 (LTS) or 2.40.4 to mitigate this vulnerability. Ensure that the hashed passwords stored on disk are adequately protected. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/prometheus/prometheus →
FAQ
Prometheus is an open-source monitoring and alerting toolkit used for large-scale distributed systems.
The vulnerability allows attackers with knowledge of the hashed password to bypass authentication and gain unauthorized access to Prometheus.
Update Prometheus to versions 2.37.4 (LTS) or 2.40.4, which include patches to address the authentication bypass vulnerability.
There is no specific workaround for this vulnerability. However, ensure that the hashed passwords stored on disk are adequately protected.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-4v48-4q5m-8vx4/GHSA-4v48-4q5m-8vx4.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/prometheus/prometheus.
