CVE-2026-42151

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42151
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42151.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-42151
Aliases
Downstream
Related
Published
2026-05-04T18:12:16.917Z
Modified
2026-06-18T03:55:54.032829474Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Prometheus Azure AD remote write OAuth client secret exposed via config API
Details

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42151.json",
    "cwe_ids": [
        "CWE-200",
        "CWE-312"
    ]
}
References

Affected packages

Git / github.com/prometheus/prometheus

Affected ranges

Type
GIT
Repo
https://github.com/prometheus/prometheus
Events
Introduced
6d80b30990bc297d95b5c844e118c4011fad8054
Fixed
dcd3d551ced8b8dc14e0217f8cb14e547109cd5f
Introduced
491734606591ef8c188f5489c70380805bc868c0
Fixed
eb173f5256d4022afba1e9bc3d19740a76859fae
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.48.0"
        },
        {
            "fixed": "3.5.3"
        },
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.11.3"
        }
    ],
    "cpe": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42151.json"