Read the docs
TI-2021-10330 Aliases CVE-2021-29622

Arbitrary redirects under /new endpoint

Priority MEDIUM 47CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-601.

Summary

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

Why it matters now

EPSS 0.1956 97th percentileScored 2026-11-07
Fix Fixed prometheus (prometheus): 2.27.1Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
prometheusprometheus2.23.0 to before 2.27.12.27.1Patch availableCNA
  • prometheus Vendorprometheus Affected 2.23.0 to before 2.27.1 Fixed in 2.27.1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*2.23.0 to before 2.26.1Vulnerableprometheus
cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*2.27.0Vulnerableprometheus
cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:*2.27.0 rc0Vulnerableprometheus
  • cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* Versions 2.23.0 to before 2.26.1 Vulnerable ·prometheus
  • cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:* Versions 2.27.0 Vulnerable ·prometheus
  • cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:* Versions 2.27.0 rc0 Vulnerable ·prometheus

Remediation

  • Fix · CNA prometheus (prometheus) Fixed in 2.27.1

Red Hat 1 advisory

  • RHSA-2021:2438 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2438
Not affected: 3 products
  • OpenShift Service Mesh 2.0
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29622

References

Advisory 3

  • TI-2026-30483 Prometheus: remote read endpoint allows denial of service via crafted snappy payload CVSS 3.1HIGH 7.5
  • TI-2026-30481 Prometheus Azure AD remote write OAuth client secret exposed via config API CVSS 3.1HIGH 7.5
  • TI-2019-02838 Cross-site scripting in [UNKNOWN] prometheus CVSS 3.0MEDIUM 6.1
  • TI-2026-28993 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer CVSS 4.0MEDIUM 5.3
  • TI-2026-32778 Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences