Log in Start free

Vulnerability · Published May 4, 2026 · Assigned by GitHub_M

CVE-2026-42151Prometheus Azure AD remote write OAuth client secret exposed via config API

High 7.5

In plain English

A high-severity information exposure in prometheus from prometheus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 71.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10opentelemetry-collector0.152.1-1.el10_2ALSA-2026:34357
AlmaLinux:9opentelemetry-collector0.152.1-1.el9_8ALSA-2026:34359
Alpine:v3.23prometheus3.5.3-r0ALPINE-CVE-2026-42151
Alpine:v3.24prometheus3.5.3-r0ALPINE-CVE-2026-42151
Debian:13prometheusno fix listedDEBIAN-CVE-2026-42151
Debian:14prometheus3.5.3+ds1-1DEBIAN-CVE-2026-42151
Gogithub.com/prometheus/prometheus0.311.3GHSA-wg65-39gg-5wfj
Gogithub.com/prometheus/prometheus0.311.3GO-2026-5710
Rocky Linux:10opentelemetry-collector0:0.152.1-1.el10_2RLSA-2026:34357
Rocky Linux:9opentelemetry-collector0:0.152.1-1.el9_8RLSA-2026:34359
Ubuntu:25.10prometheusno fix listedUBUNTU-CVE-2026-42151
Ubuntu:26.10prometheusno fix listedUBUNTU-CVE-2026-42151

Affected products (as reported)

VendorProductVersions
prometheus prometheus < 3.5.3>= 3.6.0, < 3.11.3

Weakness: CWE-200, CWE-312, CWE-256 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References