Prometheus 3.5.5 patches a dashboard sanitization flaw

Prometheus published version 3.5.5 on July 9 with a focused security fix in its web interface. The signed release record says the build updates sanitize-html to version 2.17.5 to address CVE-2026-53606 and uses Go 1.25.12.

Small releases can close exposed paths

Prometheus is often treated as an internal service, but its query and dashboard interface may be reachable by many engineers or exposed through a shared observability gateway. A dependency responsible for sanitizing HTML belongs in the security boundary of that interface. Operators on the 3.5 LTS line should therefore treat 3.5.5 as a security update rather than wait for a larger feature release.

The release is narrow, which simplifies verification. Stage the exact artifact intended for production, confirm its version and signature provenance, and run saved queries, rule views, target pages, and any reverse-proxy authentication flow. Then compare scrape health and rule evaluation metrics before and after deployment.

Inventory every server, including quiet ones

The easy failure is upgrading the primary pair while leaving development, disaster-recovery, or embedded Prometheus servers behind. Asset discovery should search deployed images and binaries, not rely only on the central service catalog.

A rollback plan still matters. Even a dependency-only update can alter rendering of annotations or links that teams use in runbooks. Preserve the previous image digest and take configuration snapshots before rollout, while avoiding rollback to the vulnerable version unless a regression makes the service unusable.

Prometheus 3.5.5 demonstrates the value of a maintained LTS path: operators can apply a bounded security correction without adopting unrelated features. The work is complete only when every reachable instance is accounted for and the UI plus monitoring pipeline pass their checks.