CVE-2026-42151: Prometheus Package Exposes Azure AD OAuth Client Secret via Config API
Summary
CVE-2026-42151: Prometheus Azure AD remote write OAuth client secret exposed via config API. Affects github.com/prometheus/prometheus versions >= 0.45.2, < 0.311.3. Fixed in 0.311.3. How to fix ↓
Also tracked for
- prometheus · Bitnami
The same CVE-2026-42151 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Prometheus is an open-source monitoring and alerting toolkit widely used for collecting and storing metrics as time series data. It provides powerful querying capabilities and integrates seamlessly with various data sources, including Azure Active Directory (AD) for remote write functionality. However, a recent vulnerability has been identified that compromises the security of Azure AD OAuth configurations.
Vulnerability Detail
The vulnerability arises from the incorrect typing of the client_secret field in the Azure AD remote write OAuth configuration. Instead of being designated as a Secret, it was typed as a plain string. This oversight allows the Azure OAuth client secret to be exposed in plaintext through the Prometheus configuration served via the /-/config HTTP API endpoint. As a result, any user or process with access to this endpoint could potentially retrieve sensitive information, leading to unauthorized access and security breaches.
How To Fix
Latest published version: v0.315.1 as of 23 Oct 2026
go get github.com/prometheus/prometheus@v0.315.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.311.3
This is the first release that contains the fix.
go get github.com/prometheus/prometheus@v0.311.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to upgrade, a temporary workaround is to switch to Managed Identity or Workload Identity authentication for Azure AD remote write. This method does not require a client secret, thereby mitigating the risk associated with the exposed client_secret field.
Conclusion
The CVE-2026-42151 vulnerability in Prometheus exposes Azure AD OAuth client secrets due to improper configuration typing. Users are strongly advised to upgrade to the patched versions to secure their applications. For those unable to upgrade, alternative authentication methods are recommended to mitigate risks.
See every vulnerability recorded for github.com/prometheus/prometheus →
FAQ
The vulnerability allows the Azure AD OAuth client secret to be exposed in plaintext, which can lead to unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of Prometheus prior to 3.11.3 and 3.5.3 LTS are affected by this vulnerability.
If an immediate upgrade is not possible, consider switching to Managed Identity or Workload Identity authentication to avoid using a client secret.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/prometheus/prometheus.
