CVE-2026-42151
Exposure of Azure AD OAuth Client Secret in Prometheus Configuration
Publication date: 2026-05-04
Last updated on: 2026-05-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| prometheus | prometheus | to 3.11.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability exposes the Azure OAuth client secret in plaintext via the /-/config HTTP API endpoint. Such exposure of sensitive authentication credentials can lead to unauthorized access and potential data breaches.
Exposure of sensitive secrets like client credentials may impact compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and secure handling of authentication information.
However, the provided information does not explicitly state the direct impact on compliance with these standards.
Can you explain this vulnerability to me?
This vulnerability exists in Prometheus versions prior to 3.5.3 and 3.11.3, where the client_secret field in the Azure AD remote write OAuth configuration was incorrectly typed as a plain string instead of a Secret type.
Because Prometheus redacts fields of type Secret when serving configuration data via the /-/config HTTP API endpoint, the client_secret field being a plain string meant that the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.
This exposure could allow unauthorized parties to view sensitive OAuth client secrets.
How can this vulnerability impact me? :
The vulnerability can lead to the exposure of the Azure OAuth client secret in plaintext to unauthorized users or processes that have access to the /-/config HTTP API endpoint.
If an attacker obtains this client secret, they could potentially misuse it to impersonate the OAuth client, gaining unauthorized access to resources or services that rely on this authentication.
This could result in a significant confidentiality breach, as indicated by the CVSS score with a high impact on confidentiality.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Prometheus to version 3.5.3 or 3.11.3 or later, where the issue has been patched.