PT-2026-36896 · Unknown · Prometheus

Brettgervasoni · Published 2026-05-04 · Updated 2026-05-25 · CVE-2026-42151

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Prometheus versions prior to 3.5.3 Prometheus versions prior to 3.11.3

Description The client secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was incorrectly typed as a string instead of a Secret. Consequently, when the configuration is served via the '/-/config' HTTP API endpoint, the Azure OAuth client secret is exposed in plaintext to any user or process with access to that endpoint, as Prometheus only redacts fields explicitly typed as Secret.

Recommendations Update to version 3.5.3. Update to version 3.11.3.

Fix

Information Disclosure

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-312

Related Identifiers

BIT-PROMETHEUS-2026-42151

CLEANSTART-2026-AP95632

CLEANSTART-2026-AX33738

CLEANSTART-2026-MV81821

CLEANSTART-2026-PM88731

CLEANSTART-2026-QS87161

CLEANSTART-2026-TL66481

CVE-2026-42151

GHSA-WG65-39GG-5WFJ

OPENSUSE-SU-2026:10676-1

Affected Products

Prometheus

References · 147

• https://github.com/prometheus/prometheus/pull/18590 · Patch
• https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj · Vendor Advisory
• https://github.com/prometheus/prometheus/pull/18587 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39817 · Security Note
• https://osv.dev/vulnerability/BIT-prometheus-2026-42151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32952 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61730 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39823 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24051 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-22868 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-TL66481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26958 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note