CVE-2021-29622

    Dashboard / Vulnerabilities / CVE-2021-29622

    CVE-2021-29622

    Published: 19 May 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

    References: https://github.com/prometheus/prometheus/releases/tag/v2.26.1, https://github.com/prometheus/prometheus/releases/tag/v2.27.1, https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 26d89b4b0776fe4cd5a3656dfa520f119a375273
    Fixed -6eeded0fdf760e81af75d9c44ce539ab77da4505

    Affected versions

    2.27.0-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-29622 | CVE-DB