# Prometheus 2.26.1 and 2.27.1 released (security releases)

**URL:** <https://discuss.prometheus.io/t/prometheus-2-26-1-and-2-27-1-released-security-releases/246>\
**Category:** Prometheus server\
**Created:** [May 19, 2021, 8:32am UTC](https://discuss.prometheus.io/t/prometheus-2-26-1-and-2-27-1-released-security-releases/246 "2021-05-19T08:32:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![roidelapluie](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/roidelapluie/32/6_2.png) [@roidelapluie](https://discuss.prometheus.io/u/roidelapluie)\
**Post date:** [May 19, 2021, 8:32am UTC](https://discuss.prometheus.io/t/prometheus-2-26-1-and-2-27-1-released-security-releases/246/1 "2021-05-19T08:32:37Z")

</div>

Hello,

The Prometheus team has released bugfix releases about an Open Redirect  
(CWE-601) security issue.  
The issue has been assigned the CVE number CVE-2021-29622.

The security issue affects Prometheus v2.23.0 to v2.26.0, and v2.27.0.

Please find more information here:

> **[Build software better, together](https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7)**
>
> theus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7

The Prometheus team thanks Aaron Devaney from MDSec for reporting this  
issue.

Timeline:  
May 12, 2021: Issue reported privately to Prometheus team  
May 12, 2021: A fix is proposed and reviewed  
May 13, 2021: CVE-2021-29622 issued by GitHub staff  
May 18, 2021: Bugfix released for the last two minor releases of  
Prometheus.

The releases can be found in the usual locations:

v2.26.1: [Release 2.26.1 / 2021-05-18 · prometheus/prometheus · GitHub](https://github.com/prometheus/prometheus/releases/tag/v2.26.1)  
v2.27.1: [Release 2.27.1 / 2021-05-18 · prometheus/prometheus · GitHub](https://github.com/prometheus/prometheus/releases/tag/v2.27.1)

Thanks,

The Prometheus Team

---

<div class="post-metadata">

**Author:** ![roidelapluie](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/roidelapluie/32/6_2.png) [@roidelapluie](https://discuss.prometheus.io/u/roidelapluie)\
**Post date:** [May 19, 2021, 8:33am UTC](https://discuss.prometheus.io/t/prometheus-2-26-1-and-2-27-1-released-security-releases/246/2 "2021-05-19T08:33:09Z")

</div>

Pinned on May 19, 2021, 8:33am UTC



---

<div class="post-metadata">

**Author:** ![roidelapluie](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/roidelapluie/32/6_2.png) [@roidelapluie](https://discuss.prometheus.io/u/roidelapluie)\
**Post date:** [May 19, 2021, 8:33am UTC](https://discuss.prometheus.io/t/prometheus-2-26-1-and-2-27-1-released-security-releases/246/3 "2021-05-19T08:33:20Z")

</div>

Unpinned on May 19, 2021, 8:33am UTC



---

<div class="post-metadata">

**Author:** ![roidelapluie](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/roidelapluie/32/6_2.png) [@roidelapluie](https://discuss.prometheus.io/u/roidelapluie)\
**Post date:** [May 19, 2021, 8:33am UTC](https://discuss.prometheus.io/t/prometheus-2-26-1-and-2-27-1-released-security-releases/246/4 "2021-05-19T08:33:28Z")

</div>

Pinned globally on May 19, 2021, 8:33am UTC