Prometheus Azure AD remote write OAuth client secret exposed via config API
High7.5CVE-2026-42151 · Published May 5, 2026 · updated Sep 9, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/prometheus/prometheus Go | >= 0.45.2, < 0.311.3 | 0.311.3 |
Details and references
### Impact Users who use Azure AD remote write with OAuth authentication are impacted. The `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. ### Patches The problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS. ### Workarounds Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200, CWE-256, CWE-312
- Also known as
- BIT-prometheus-2026-42151, CVE-2026-42151, GO-2026-5710
- github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj
- nvd.nist.gov/vuln/detail/CVE-2026-42151
- github.com/prometheus/prometheus/pull/18590
- github.com/prometheus/prometheus/pull/18587
- access.redhat.com/errata/RHSA-2026:60388
- access.redhat.com/errata/RHSA-2026:60387
- access.redhat.com/errata/RHSA-2026:60386
- access.redhat.com/errata/RHSA-2026:57191
- access.redhat.com/errata/RHSA-2026:56340
- access.redhat.com/errata/RHSA-2026:54427
- access.redhat.com/errata/RHSA-2026:54288
- access.redhat.com/errata/RHSA-2026:53530
- access.redhat.com/errata/RHSA-2026:53415
- access.redhat.com/errata/RHSA-2026:53413
- access.redhat.com/errata/RHSA-2026:53412
- access.redhat.com/errata/RHSA-2026:50874
- access.redhat.com/errata/RHSA-2026:50843
- access.redhat.com/errata/RHSA-2026:60389
- access.redhat.com/errata/RHSA-2026:60390
- access.redhat.com/errata/RHSA-2026:60391
- access.redhat.com/errata/RHSA-2026:60441
- access.redhat.com/errata/RHSA-2026:60477
- access.redhat.com/errata/RHSA-2026:63103
- access.redhat.com/security/cve/CVE-2026-42151
- bugzilla.redhat.com/show_bug.cgi?id=2466507
- github.com/prometheus/prometheus
- github.com/prometheus/prometheus/releases/tag/v3.11.3
- github.com/prometheus/prometheus/releases/tag/v3.5.3
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42151.json
- access.redhat.com/errata/RHSA-2026:25039
More prometheus advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 5 | Prometheus: Remote read endpoint allows denial of service via crafted snappy payload CVE-2026-42154High7.5fixed in 0.305.2, 0.311.3 | High7.5 | 0.305.2, 0.311.3 |
| May 5 | Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display CVE-2026-44903Medium6.1fixed in 0.311.3 | Medium6.1 | 0.311.3 |
| Apr 13 | Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer CVE-2026-40179Medium6.1fixed in 0.311.2-0.20260410083055-07c6232d159b | Medium6.1 | 0.311.2-0.20260410083055-07c6232d159b |
| Dec 52022 | Prometheus vulnerable to basic authentication bypass GHSA-4v48-4q5m-8vx4High7.2fixed in 2.37.4, 2.40.4 | High7.2 | 2.37.4, 2.40.4 |