VictoriaMetrics v1.148.4

Released at 2026-09-11

v1.148.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise. All these fixes are also included in the latest community release. The v1.148.x line will be supported for at least 12 months since v1.148.0 release

• SECURITY: upgrade Go builder from Go1.26.6 to Go1.26.7. See the list of issues addressed in Go1.26.7.

• SECURITY: vmauth: fix authorization bypass in JWT-based routing when match_claims values are used. See GHSA-f99m-22fh-qw96.

• SECURITY: vmsingle and vmselect in VictoriaMetrics cluster: properly escape server-side errors returned by /metric-relabel-debug since they could contain parts of user input. This prevents XSS attacks on the /vmui/#/relabeling page. See GHSA-vw10j-rqhg-qff9.

• BUGFIX: all VictoriaMetrics components: hide values passed to -pushmetrics.header in startup logs, /metrics, and /flags, since they can contain sensitive HTTP headers such as Authorization and API keys. See #11545.

• BUGFIX: vmsingle, vmagent and vminsert in VictoriaMetrics cluster: fix insert requests getting stuck after another insert request times out, causing clients to time out while waiting for a response. See VictoriaLogs#1743.

• BUGFIX: vmselect in VictoriaMetrics cluster: apply the le filter at /api/v1/status/metric_names_stats after merging request counters from all vmstorage nodes. Previously, the endpoint could report actively queried metrics as unused when the local request counter was zero on one of the nodes. See #11473. Thanks to @missusk for contribution.

• BUGFIX: vmagent: now MDX discards cardinality_estimate and cardinality_churn_ratio metrics exposed by vmestimator service. #11501.

• BUGFIX: vmselect in VictoriaMetrics cluster: allow access to /prometheus/api/v1/admin/tsdb/delete_series and graphite/tags/delSeries using only the corresponding -deleteAuthKey, even when -httpAuth.* is also configured, without additionally requiring -httpAuth.* credentials. See #11512.