CVE-2026-42151 prometheus CVE debrief

Who should care

Defenders responsible for Prometheus instances, especially those using Azure AD remote write OAuth, should assess their exposure and apply patches or mitigations to prevent unauthorized access to sensitive configuration information.

Why it matters

CVE-2026-42151 is a high-severity vulnerability in Prometheus that exposes the Azure OAuth client secret in plaintext, allowing potential unauthorized access to sensitive configuration information. Defenders should prioritize verifying exposure and applying patches or mitigations.

• Verify exposure of Azure OAuth client secret via the /-/config HTTP API endpoint.
• Apply patches or mitigations to prevent unauthorized access to sensitive configuration information.
• Review and update configuration to ensure sensitive information is properly secured.

Technical summary

The client_secret field in the Azure AD remote write OAuth configuration of Prometheus was incorrectly typed as a string instead of a Secret. This led to the exposure of the Azure OAuth client secret in plaintext via the /-/config HTTP API endpoint. The issue has been resolved in versions 3.5.3 and 3.11.3 by correcting the field type to Secret, which redacts the field when served via the API endpoint.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent unauthorized access to sensitive configuration information.

Recommended defensive actions

• Verify exposure by checking if the Prometheus instance is configured to use Azure AD remote write OAuth and if the client_secret field is typed as a string.
• Apply patches or mitigations by upgrading to versions 3.5.3 or 3.11.3, or later.
• Review and update configuration to ensure sensitive information is properly secured and not exposed via the /-/config HTTP API endpoint.
• Perform a thorough review of the Prometheus configuration to identify potential security risks.
• Implement additional monitoring to detect potential unauthorized access to sensitive configuration information.
• Conduct a security audit to ensure that all sensitive information is properly secured.
• Document and track the remediation process for future reference.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and available patches. Multiple source references, including GitHub pull requests and release notes, support the details of the vulnerability and its resolution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.