CVE-2026-42151: Prometheus Azure AD remote write OAuth client secret exposed via config API
Impact
Users who use Azure AD remote write with OAuth authentication are impacted.
The clientsecret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.
Patches
The problem has been patched by changing ClientSecret in OAuthConfig to Secret. Users should upgrade to 3.11.3 or 3.5.3 LTS.
Workarounds
Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.
Other sources
Prometheus Azure AD remote write OAuth client secret exposed via config API
— Microsoft
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/prometheus/prometheusto a version that resolves this vulnerability.Fixed in 0.311.3 - Upgrade
Upgrade
Prometheus (storage/remote/azuread OAuthConfig client_secret field type)to a version that resolves this vulnerability.Fixed in 3.5.3 - Upgrade
Upgrade
Prometheus (storage/remote/azuread OAuthConfig client_secret field type)to a version that resolves this vulnerability.Fixed in 3.11.3 - Configuration
Ensure the Azure AD remote write OAuth client_secret field in storage/remote/azuread is typed as Secret (not string) so Prometheus redacts it on the /-/config HTTP API endpoint.
Prometheus Azure AD remote write OAuth configuration (storage/remote/azuread) client_secret type (client_secret field in OAuthConfig) = Secret - Compensating control
If you cannot upgrade, switch Prometheus Azure AD remote write authentication from OAuth client secret to Managed Identity or Workload Identity (no client secret is involved).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42151?
CVE-2026-42151 is classified as a high-severity vulnerability due to the exposure of sensitive OAuth client secrets.
How do I fix CVE-2026-42151?
To fix CVE-2026-42151, upgrade Prometheus to version 3.5.3 or later, or 3.11.3 or later.
What components are affected by CVE-2026-42151?
CVE-2026-42151 affects the Azure AD remote write OAuth configuration in Prometheus prior to specified versions.
What is the impact of CVE-2026-42151 on my system?
The impact of CVE-2026-42151 includes potential unauthorized access due to the exposure of OAuth client secrets.
Is there a workaround for CVE-2026-42151?
There are no known workarounds for CVE-2026-42151, so updating to a patched version is necessary.