CVE-2026-42151

Modified Modified - Updated After Analysis

Exposure of Azure AD OAuth Client Secret in Prometheus Configuration

Publication date: 2026-05-04

Last updated on: 2026-07-02

Assigner: GitHub, Inc.

Description

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-07-02

Generated

2026-07-06

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-42151

EUVD

EUVD-2026-27089

Affected Vendors & Products

Vendor	Product	Version / Range
prometheus	prometheus	From 3.6.0 (inc) to 3.11.3 (exc)
prometheus	prometheus	From 2.48.0 (inc) to 3.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-256	The product stores a password in plaintext within resources such as memory or files.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Prometheus versions prior to 3.5.3 and 3.11.3, where the client_secret field in the Azure AD remote write OAuth configuration was incorrectly typed as a plain string instead of a Secret type.

Because Prometheus redacts fields of type Secret when serving configuration data via the /-/config HTTP API endpoint, the client_secret field being a plain string meant that the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.

This exposure could allow unauthorized parties to view sensitive OAuth client secrets.

Impact Analysis

The vulnerability can lead to the exposure of the Azure OAuth client secret in plaintext to unauthorized users or processes that have access to the /-/config HTTP API endpoint.

If an attacker obtains this client secret, they could potentially misuse it to impersonate the OAuth client, gaining unauthorized access to resources or services that rely on this authentication.

This could result in a significant confidentiality breach, as indicated by the CVSS score with a high impact on confidentiality.

Mitigation Strategies

To mitigate this vulnerability, upgrade Prometheus to version 3.5.3 or 3.11.3 or later, where the issue has been patched.

Compliance Impact

This vulnerability exposes the Azure OAuth client secret in plaintext via the /-/config HTTP API endpoint. Such exposure of sensitive authentication credentials can lead to unauthorized access and potential data breaches.

Exposure of sensitive secrets like client credentials may impact compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and secure handling of authentication information.

However, the provided information does not explicitly state the direct impact on compliance with these standards.

Hi! I’m here to help you understand CVE-2026-42151. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70