~ / search / GHSA-wg65-39gg-5wfj

GHSA-wg65-39gg-5wfj

Prometheus Azure AD remote write OAuth client secret exposed via config API

Source: GitHub Advisory Database (reviewed) High CVE-2026-42151

Packages

EcosystemPackageAffectedFixed in
Go github.com/prometheus/prometheus >= 0.45.2, < 0.311.3 0.311.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Users who use Azure AD remote write with OAuth authentication are impacted. The `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. ### Patches The problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS. ### Workarounds Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.

References

External links from the advisory. They lead to third-party sites.