Prometheus · week of 2 Nov 2026

Prometheus security note

Records on this stack that changed between 2 Nov 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.

What changed

CVE-2026-33374 — Check if you run it
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the serv
Fixed in 12.4.14-r0

What we still do not know

Every changed record in this note has a version range.

Share this note

Prometheus security note, week of 2 Nov 2026: 1 record has a version a customer can check, and 0 still do not. https://zerodayfindings.com/technologies/prometheus/notes/2026-W45