CVE catalog

CVE-2026-42151

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/az

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 25, 2026

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianprometheussid3.5.3+ds1-6fixed
Debianprometheusforky3.5.3+ds1-6fixed
Debianprometheustrixie2.53.3+ds1-2vulnerable
Debianprometheusbookworm2.42.0+ds-5+deb12u1not affected
CpeprometheusNot reported3.5.3fixed
CpeprometheusNot reported3.11.3fixed
Gogithub.com/prometheus/prometheusNot reported0.311.3fixed
CpeprometheusNot reported3.11.3fixed
Opensusegolang-github-prometheus-prometheustumbleweed3.11.3-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianprometheussourcesid3.5.3+ds1-1unimportantNot reported[1135999]
Debianprometheussourceforky3.5.3+ds1-1unimportantNot reported[1135999]
Debianprometheussourcetrixie(unfixed)unimportantNot reported[1135999]
DebianprometheussourcebookwormNot affectedunimportantNot reported[1135999]
CpeprometheuscpeNot reported3.5.3Not reportedNot reportedNot reported
CpeprometheuscpeNot reported3.11.3Not reportedNot reportedNot reported
Gogithub.com/prometheus/prometheusgoNot reported0.311.3Not reportedGHSA-WG65-39GG-5WFJNot reported
CpeprometheuscpeNot reported3.11.3Not reportedNVD-CVE-2026-42151Not reported
Opensusegolang-github-prometheus-prometheusrpmtumbleweed3.11.3-1.1Not reportedOPENSUSE-SU-2026:10676-1Not reported

[Debian bug #1135999]

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [golang-github-prometheus-prometheus-dev]Affected

    Source package: [prometheus]

    Details (2)

    • 2.53.3+ds1-2 · all · trixie

      Affected

      nvd · prometheus · debian · 13

    • 2.53.3+ds1-2 · all · trixie

      Affected

      nvd · prometheus · debian · 13

  • [prometheus]Affected
    Details (2)

    • 2.53.3+ds1-2 · amd64 · trixie

      Affected

      nvd · prometheus · debian · 13

    • 2.53.3+ds1-2 · arm64 · trixie

      Affected

      nvd · prometheus · debian · 13

  • [promtool]Affected

    Source package: [prometheus]

    Details (2)

    • 2.53.3+ds1-2 · amd64 · trixie

      Affected

      nvd · prometheus · debian · 13

    • 2.53.3+ds1-2 · arm64 · trixie

      Affected

      nvd · prometheus · debian · 13

[Debian 12 (Bookworm)]

  • [prometheus]Not affected
    Details (2)

    • 2.42.0+ds-5+deb12u1 · amd64 · bookworm

      Not affected

      nvd · prometheus · debian · bookworm

    • 2.42.0+ds-5+deb12u1 · arm64 · bookworm

      Not affected

      nvd · prometheus · debian · bookworm

[openSUSE Tumbleweed]

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]