VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 25, 2023· Updated Feb 13, 2025

Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

CVE-2023-40577

Description

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2023-40577: Stored XSS in Alertmanager via POST /api/v1/alerts allows arbitrary JavaScript execution, fixed in v0.25.1.

Vulnerability

Overview

Alertmanager, a component that handles alerts from Prometheus and other clients, is vulnerable to a stored cross-site scripting (XSS) attack. The vulnerability resides in the /api/v1/alerts endpoint. An attacker with permission to send POST requests to this endpoint can inject arbitrary JavaScript code into alert data that will later be rendered in the Alertmanager UI. This issue has been fixed in Alertmanager version 0.25.1.

Attack

Vector and Prerequisites

An attacker must have the ability to perform authenticated POST requests to the /api/v1/alerts endpoint. No special network position is required beyond network access to the Alertmanager instance. The attack complexity is low, as the injected payload is simply included in the alert payload. User interaction is required because a victim must view the crafted alert in the UI for the script to execute. The scope is changed because the XSS affects the browser of the user, not the Alertmanager server itself.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session when they view the malicious alert. This can lead to session hijacking, theft of credentials or tokens, defacement of the UI, or further actions on behalf of the victim. The impact on confidentiality, integrity, and availability is considered high as the attacker can perform any action the user can.

Mitigation

The vulnerability is patched in Alertmanager version 0.25.1. Users are strongly advised to upgrade. No workarounds are provided in the advisory. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.

References

[1] [2] [3]

References
  1. GitHub - prometheus/alertmanager: Prometheus Alertmanager
  2. NVD - CVE-2023-40577
  3. Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/prometheus/alertmanagerGo
< 0.25.10.25.1

Affected products

65

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.