Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
Priority MEDIUM 40CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00634 50th percentileScored 2026-11-07
Fix Fixed github.com/prometheus/alertmanager (Go): 0.25.1Red Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| prometheus | alertmanager | up to 0.25.0 | — | No fix listed | CNA |
| — | github.com/prometheus/alertmanager (Go) | before 0.25.1 | 0.25.1 | Patch available | GHSA-v86x-5fm3-5p7j |
- alertmanager Vendorprometheus Affected up to 0.25.0 Fixed in — No fix listed CNA
- github.com/prometheus/alertmanager (Go) Vendor— Affected before 0.25.1 Fixed in 0.25.1 Patch available GHSA-v86x-5fm3-5p7j
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:prometheus:alertmanager:0.25.0:*:*:*:*:*:*:* | 0.25.0 | Vulnerable | prometheus |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:prometheus:alertmanager:0.25.0:*:*:*:*:*:*:* Versions 0.25.0 Vulnerable ·prometheus
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-v86x-5fm3-5p7j github.com/prometheus/alertmanager (Go) Fixed in 0.25.1 Advisory →
Red Hat 1 advisory
- RHSA-2023:7198 Released 2024-02-27 · Red Hat rating CriticalOpenShift Container Platform 4.15.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2023:7198 |
Not affected: 3 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4.15
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40577
- 2026-10-03 Alias added: GHSA-v86x-5fm3-5p7j
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Sources
- CVE-2023-40577 · CVE Program
- CVE-2023-40577 · NVD
- FIRST EPSS
- GHSA-v86x-5fm3-5p7j · GitHub Advisory Database · CC BY 4.0
- CVE-2023-40577 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences