- Add vm_backup_errors_total{type="restoreState"} metric to track backup state restore failures
- The /api/v1/admin/tsdb/delete_series and /tags/delSeries endpoints now require POST method instead of accepting GET requests
- vmbackupmanager no longer crashes on startup when it fails to restore backup state from remote storage, instead logging the error and continuing to run with retries
- Restrict /api/v1/admin/tsdb/delete_series and /tags/delSeries endpoints to POST method only to prevent SSRF-based data deletion attacks
v1.136.15
Released at 2026-07-31
v1.136.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise. All these fixes are also included in the latest community release. The v1.136.x line will be supported for at least 12 months since v1.136.0 release
Update Note 1: vmsingle and vmselect in VictoriaMetrics cluster: the /api/v1/admin/tsdb/delete_series, /tags/delSeries endpoints now require POST method. Previously, it also accepted GET requests. If you use GET requests for this endpoint, update your scripts or tooling to use POST instead. See #5552.
-
SECURITY: vmsingle and
vmselectin VictoriaMetrics cluster: restrict/api/v1/admin/tsdb/delete_series,/tags/delSeriesendpoints toPOSTmethod only to prevent some SSRF-based data deletion attacks. See #5552. -
BUGFIX: vmbackupmanager: previously,
vmbackupmanagerwas crashing on startup when it failed to restore backup state from remote storage, causing a crash loop. Now it logs the error and continues running, retrying the state restore before each scheduled backup. Addedvm_backup_errors_total{type="restoreState"}metric to track backup state restore failures. See #11217.