Prometheus: remote_write follows 3xx redirects with the bearer token attached, leaking cloud credentials

Impact

Prometheus through 3.15.1 replays its Azure AD or Google IAM bearer token when a remote_write request is redirected, so whoever controls the remote-write endpoint - or any host that can return a 3xx in that path - captures a working cloud token. The token is the one the monitoring stack uses to write to the metrics backend, so an attacker can at minimum forge or poison metrics for the whole fleet, and the blast radius is whatever else that identity is granted. For a GPU operator this is the credential behind DCGM, node-exporter and job-level telemetry across the cluster: poisoned or deleted metrics break capacity accounting, thermal and XID alerting, and the autoscaling and eviction decisions built on them. Exploitation requires the attacker to be in a position to control or redirect the remote-write destination, which is why the score is moderate.

Who can reach it

Network. An attacker who controls the configured remote-write endpoint, or an intermediary able to answer those requests with a redirect, captures the token. No authentication to Prometheus itself is required - the victim is Prometheus's outbound write path.

What to do

Upgrade Prometheus once a release carrying the prometheus/common fix (PR 901) ships; no fixed Prometheus version is named in the record, so track that PR rather than assume a version. Mitigate now: pin remote_write to endpoints you control over TLS with certificate validation, disable or constrain redirect following at the egress proxy, and scope the Azure AD / Google IAM identity to metric writes only. Applying the fix is a Prometheus restart, not a node action; rotate the bearer-token identity if you believe a redirect was ever followed.

References

Related entries

• Grafana: org admin can delete other organizations' snapshots and recover delete keys from share keysCVE-2026-19197 · Grafana (dashboard snapshot API)Medium
• CZ.NIC BIRD Internet Routing Daemon (BGP AS_PATH mask matching): Stack-based buffer overflow in BIRD's AS_PATH maskCVE-2026-49943 · CZ.NIC BIRD Internet Routing Daemon (BGP AS_PATH mask matching)Medium
• Jenkins: agent config update names its own target, letting one agent's configurer take over anotherCVE-2026-84651 · Jenkins controller (REST API and CLI agent configuration update)Medium
• Grafana Azure Monitor data source (resource proxy): A Grafana user who only has query access to an Azure Monitor dataCVE-2026-93294 · Grafana Azure Monitor data source (resource proxy)Medium
• Prometheus (exporter-toolkit): Poisoning the built-in auth cache bypasses basic-auth on exportersCVE-2022-46146 · Prometheus (exporter-toolkit)Medium
• GitLab: Pages logs and error-tracking events record request secrets, exposing access tokensCVE-2026-101168 · GitLab CE/EE (GitLab Pages request logging and error tracking)Medium