Is CVE-2026-44903 actively exploited?

No active exploitation of CVE-2026-44903 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44903 be exploited remotely?

Yes. CVE-2026-44903 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44903?

CVE-2026-44903 has a CVSS score of 5.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-44903

MEDIUM

CVE-2026-44903

CWE-79Published: May 26, 2026· Updated: May 29, 2026

5.1

CVSS v3.1

Official Description

Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.

NVD Source

Technical Analysis

CVE-2026-44903 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.Low

User InteractionP

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X