GitHub Advisoryadvisory · Go

GHSA-wg65-39gg-5wfj Prometheus Azure AD remote write OAuth client secret exposed via config API

HIGH Published 2026-05-05 Modified 2026-09-09 Official page ↗
Aliases
CVE-2026-42151
Ecosystem
Go
Packages
github.com/prometheus/prometheus
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-256, CWE-312
Reviewed
2026-05-05

Affected packages

• Go github.com/prometheus/prometheus: >= 0.45.2, < 0.311.3 → fixed in 0.311.3

Description

Impact Users who use Azure AD remote write with OAuth authentication are impacted. The `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. Patches The problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS. Workarounds Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.

Related

Alias · CVE (1)

  • CVE-2026-42151 Prometheus is an open-source monitoring system and time series database. vulnerability

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References