Bug 2466507 (CVE-2026-42151) - CVE-2026-42151 github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
Summary: CVE-2026-42151 github.com/prometheus/prometheus: Prometheus: Information disc...
Keywords:
Status: NEW
Alias: CVE-2026-42151
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2481310 2493641 2493642 2493643 2493644 2481308 2481309
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-04 19:02 UTC by OSIDB Bzimport
Modified: 2026-07-08 15:50 UTC (History)
56 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:34357 0 None None None 2026-07-01 18:36:08 UTC
Red Hat Product Errata RHSA-2026:34359 0 None None None 2026-07-01 19:21:04 UTC
Red Hat Product Errata RHSA-2026:36796 0 None None None 2026-07-08 15:50:54 UTC

Description OSIDB Bzimport 2026-05-04 19:02:50 UTC 
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.
Comment 3 errata-xmlrpc 2026-07-01 18:36:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:34357 https://access.redhat.com/errata/RHSA-2026:34357
Comment 4 errata-xmlrpc 2026-07-01 19:21:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:34359 https://access.redhat.com/errata/RHSA-2026:34359
Comment 8 errata-xmlrpc 2026-07-08 15:50:50 UTC 
This issue has been addressed in the following products:

  RHEM 1.0 for RHEL 9

Via RHSA-2026:36796 https://access.redhat.com/errata/RHSA-2026:36796
Note You need to log in before you can comment on or make changes to this bug.