There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and
    3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the
    Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In
    both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing
    HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use
    dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without
    sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like
    <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised
    scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of
    any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration,
    data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions
    3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are
    recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP
    receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets
    are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g.,
    --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested;
    and refrain from clicking untrusted links, particularly those containing functions such as label_replace,
    as they may generate poisoned label names and values. (CVE-2026-40179)

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread)
    was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the
    configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth
    client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has
    been patched in versions 3.5.3 and 3.11.3. (CVE-2026-42151)

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-
    compressed request body before allocating memory. An unauthenticated attacker can send a small payload
    that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory
    and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and
    3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the
    Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In
    both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing
    HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use
    dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without
    sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like
    <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised
    scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of
    any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration,
    data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions
    3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are
    recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP
    receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets
    are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g.,
    --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested;
    and refrain from clicking untrusted links, particularly those containing functions such as label_replace,
    as they may generate poisoned label names and values. (CVE-2026-40179)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Prometheus 是一個開源監控系統和時間序列資料庫。自始至終3.5.13.6.03.11.1的版本3.0已將跨網站指令碼漏洞儲存在 Prometheus Web UI 的多個元件中，其中指標名稱和標籤值被注入 innerHTML 而不逸出。在 Mantine UI 和舊的 React UI 中，圖形頁面上的圖表工具提示會呈現包含 HTML/JavaScript 的量度名稱，而無需清理。在舊的 React UI 中，Metric Explorer 模糊搜尋結果使用 dangerouslySetInnerHTML 而不轉義，熱圖儲存格工具提示插入 le 標籤值 無需清理。由於 Prometheus v3.x 預設為 UTF-8 度量和標籤名稱驗證，<、> 等字元現在在度量名稱和標籤中都有效。攻擊者若能透過受損的抓取目標、遠端寫入或 OTLP 接收端點插入指標，則可以在任何在圖形 UI 中檢視指標的 Prometheus 使用者的瀏覽器中執行任意 JavaScript，根據啟用的旗標，可能會啟用設定洩漏、資料刪除或 Prometheus 關閉。此問題已在版本 3.5.2 和 3.11.2中修正。如果開發人員無法立即更新，建議採取以下因應措施：確保遠端寫入接收者 （--web.enable-remote-write-receiver） 和 OTLP 接收者 （--web.enable-otlp-receiver） 不會暴露給不受信任的來源;驗證所有抓取目標是否受信任且不受攻擊者控制;避免啟用管理員或變更 API 端點 （例如
    --web.enable-admin-api 或 --web.enable-lifecycle） 在可能擷取不受信任資料的環境中;
    並避免點擊不受信任的鏈接，尤其是那些包含label_replace等功能的鏈接，因為它們可能會生成有毒的標籤名稱和值。（CVE-2026-40179）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Prometheus 是一个开源监控系统和时间序列数据库。整个3.5.1版本和3.6.0整个3.11.1版本3.0都在 Prometheus Web UI 的多个组件中存储了跨站脚本漏洞，其中度量名称和标签值在未转义的情况下被注入到 innerHTML 中。在 Mantine UI 和旧的 React UI 中，Graph 页面上的图表工具提示呈现包含 HTML/JavaScript 的指标名称，而无需进行审查。在旧的 React UI 中，指标资源管理器模糊搜索结果使用危险的 SetInnerHTML 而不转义，热图单元格工具提示插入 le 标签值而不进行审查。随着 Prometheus v3.x 默认采用 UTF-8 指标和标签名称验证，<、> 等字符现在在指标名称和标签中都有效。攻击者若能通过遭到入侵的抓取目标、远程写入或 OTLP 接收端点注入指标，便可在 Graph UI 中查看指标的任何 Prometheus 用户的浏览器中执行任意 JavaScript，进而可能利用此漏洞造成配置渗漏、数据删除或 Prometheus 关闭，取决于已启用的标志。已在版本 3.5.2 和 3.11.2中修复此问题。如果开发人员无法立即更新，建议采用以下变通方案：确保远程写入接收方 （--web.enable-remote-write-receiver） 和 OTLP 接收方 （--web.enable-otlp-receiver） 没有暴露给不受信任的来源;验证所有抓取目标都受到信任且不受攻击者控制;避免启用管理或更改 API 端点（例如
    --web.enable-admin-api 或 --web.enable-lifecycle），安装在可能包含不受信任数据的环境中;
    并且不要点击不受信任的链接，尤其是那些包含 label_replace 等函数的链接，因为它们可能会生成中毒的标签名称和值。（CVE-2026-40179）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Prometheus は、オープンソースのモニタリングシステムおよび時系列データベースです3.0 から 3.5.1 までのバージョンおよび 3.6.0 から 3.11.1 までのバージョンでは、Prometheus Web UI の複数のコンポーネントにクロスサイトスクリプティングの脆弱性が蓄積されています。この脆弱性では、メトリクス名とラベル値がエスケープせずに innerHTML に注入されます。Mantine UI と古い React UI の両方で、グラフページのチャートツールチップは、HTML/JavaScript を含むメトリック名をサニタイズせずにレンダリングします。古い React UI では、Metric Explorer のあいまい検索結果はエスケープせずに dangerouslySetInnerHTML を使用し、ヒートマップ セルのツールチップはサニタイズせずにラベルの値を補間します。Prometheus v3.xがUTF-8メトリックとラベル名の検証にデフォルトになったため、<、>、などの文字がメトリック名とラベルで有効になりました。侵害されたスクレイプターゲット、リモート書き込み、またはOTLP受信者エンドポイントを介してメトリックを挿入できる攻撃者が、グラフUIでメトリックを表示しているPrometheusユーザーのブラウザーで任意のJavaScriptを実行し、有効なフラグによっては構成の抜き取り、データ削除、またはPrometheusのシャットダウンを引き起こす可能性があります。この問題は、バージョン 3.5.2 および 3.11.2 で修正されました。開発者がすぐに更新できない場合は、次の回避策をお勧めします。リモート書き込みレシーバー(--web.enable-remote-write-receiver)とOTLPレシーバー(--web.enable-otlp-receiver)が信頼できないソースに公開されていないことを確認する。すべてのスクレイプターゲットが信頼され、攻撃者の制御下にないことを検証する。管理を有効にしたり、APIエンドポイントを変更したりする(例:
    --web信頼できないデータが取り込まれる可能性のある環境での.enable-admin-apiまたは --web.enable-lifecycle)。
    また、信頼できないリンク、特に label_replace などの関数を含むリンクは、侵害されたラベルの名前や値を生成する可能性があるため、クリックしないでください。(CVE-2026-40179)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and     3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the     Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In     both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing     HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use     dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without     sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like     <, >, and  are now valid in metric names and labels. An attacker who can inject metrics via a compromised     scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of     any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration,     data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions     3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are     recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP     receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets     are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g.,
    --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested;
    and refrain from clicking untrusted links, particularly those containing functions such as label_replace,     as they may generate poisoned label names and values. (CVE-2026-40179)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
441027	Alpine: multiple prometheus packages: security update to 3.5.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/4/30	2026/7/2	medium
441027	Alpine: multiple prometheus packages: security update to 3.5.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/4/30	2026/7/2	medium
440929	SCA: security update for github.com/prometheus/prometheus (GHSA-vffh-x6r8-xx99)	Tenable Cloud Security	SCA Checks	2026/4/27	2026/7/2	medium
440929	SCA: security update for github.com/prometheus/prometheus (GHSA-vffh-x6r8-xx99)	Tenable Self-Hosted Container Security	SCA Checks	2026/4/27	2026/7/2	medium
307590	Linux Distros 未修補的弱點：CVE-2026-40179	Nessus	Misc.	2026/4/20	2026/7/25	medium
307590	Linux Distros 未修补的漏洞：CVE-2026-40179	Nessus	Misc.	2026/4/20	2026/7/25	medium
307590	Linux Distros のパッチ未適用の脆弱性: CVE-2026-40179	Nessus	Misc.	2026/4/20	2026/7/25	medium
307590	Linux Distros Unpatched Vulnerability : CVE-2026-40179	Nessus	Misc.	2026/4/20	2026/7/25	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium