CVE-2026-42151
Analyzed Analyzed - Analysis Complete
Exposure of Azure AD OAuth Client Secret in Prometheus Configuration

Publication date: 2026-05-04

Last updated on: 2026-05-11

Assigner: GitHub, Inc.

Description
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-04
Last Modified
2026-05-11
Generated
2026-06-16
AI Q&A
2026-05-05
EPSS Evaluated
2026-06-15
NVD
CVE-2026-42151
EUVD
EUVD-2026-27089
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
prometheus prometheus From 3.6.0 (inc) to 3.11.3 (exc)
prometheus prometheus From 2.48.0 (inc) to 3.5.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Prometheus versions prior to 3.5.3 and 3.11.3, where the client_secret field in the Azure AD remote write OAuth configuration was incorrectly typed as a plain string instead of a Secret type.

Because Prometheus redacts fields of type Secret when serving configuration data via the /-/config HTTP API endpoint, the client_secret field being a plain string meant that the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.

This exposure could allow unauthorized parties to view sensitive OAuth client secrets.

Impact Analysis

The vulnerability can lead to the exposure of the Azure OAuth client secret in plaintext to unauthorized users or processes that have access to the /-/config HTTP API endpoint.

If an attacker obtains this client secret, they could potentially misuse it to impersonate the OAuth client, gaining unauthorized access to resources or services that rely on this authentication.

This could result in a significant confidentiality breach, as indicated by the CVSS score with a high impact on confidentiality.

Mitigation Strategies

To mitigate this vulnerability, upgrade Prometheus to version 3.5.3 or 3.11.3 or later, where the issue has been patched.

Compliance Impact

This vulnerability exposes the Azure OAuth client secret in plaintext via the /-/config HTTP API endpoint. Such exposure of sensitive authentication credentials can lead to unauthorized access and potential data breaches.

Exposure of sensitive secrets like client credentials may impact compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and secure handling of authentication information.

However, the provided information does not explicitly state the direct impact on compliance with these standards.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42151. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart