CVE-2026-42151

Name of the Vulnerable Software and Affected Versions Prometheus versions prior to 3.5.3 Prometheus versions prior to 3.11.3

Description The client secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was incorrectly typed as a string instead of a Secret. Consequently, when the configuration is served via the '/-/config' HTTP API endpoint, the Azure OAuth client secret is exposed in plaintext to any user or process with access to that endpoint, as Prometheus only redacts fields explicitly typed as Secret.

Recommendations Update to version 3.5.3. Update to version 3.11.3.