CVE-2026-42151

EUVD-2026-27089
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 27.89%
Affected Products (NVD)
VendorProductVersion
prometheusprometheus
2.48.0 ≤
𝑥
< 3.5.3
prometheusprometheus
3.6.0 ≤
𝑥
< 3.11.3
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:0.152.1-1.el10_2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:0.152.1-1.el9_8 ≤
𝑥
< *
ADP
Red HatRHEM 1.0 for RHEL 9
0:1.0.3-1.el9em ≤
𝑥
< *
ADP
Red HatRHEM 1.1 for RHEL 10
0:1.1.3-1.el10em ≤
𝑥
< *
ADP
Red HatRHEM 1.1 for RHEL 9
0:1.1.3-1.el9em ≤
𝑥
< *
ADP
Red HatLogging for Red Hat OpenShift 6.2
1784747884 ≤
𝑥
< *
ADP
Red HatLogging for Red Hat OpenShift 6.2
1784747816 ≤
𝑥
< *
ADP
Red HatLogging for Red Hat OpenShift 6.2
1784747815 ≤
𝑥
< *
ADP
Red HatLogging Subsystem for Red Hat OpenShift 6.0
1785418915 ≤
𝑥
< *
ADP
Red HatLogging Subsystem for Red Hat OpenShift 6.0
1785418855 ≤
𝑥
< *
ADP
Red HatLogging Subsystem for Red Hat OpenShift 6.0
1785418852 ≤
𝑥
< *
ADP
Red HatMulticluster Global Hub 1.5.4
1784562060 ≤
𝑥
< *
ADP
Red HatMulticluster Global Hub 1.7.1
1784906628 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502022 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502465 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502025 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502494 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502401 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502403 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502022 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502023 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502029 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502445 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194638 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194353 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784196588 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784195620 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194309 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194144 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194188 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194653 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194144 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194980 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194347 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194971 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784128388 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784128860 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784126780 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784127787 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784126762 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784127762 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784126832 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784126774 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784127791 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784127135 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784126733 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784127775 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
2.19.0-1.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
0.153.0-1.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
0.153.0-1.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat multicluster global hub 1.4.4
1784060681 ≤
𝑥
< *
ADP
Red HatRed Hat multicluster global hub 1.6.0
1784561376 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.22
1784125078 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.1
1783750447 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.12
1783751865 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.12
1784353904 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.15
1784351966 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.16
1783955846 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.9
1784125838 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.3
1783968861 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.3
1783968861 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.3
1783968468 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.3
1783960127 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.3
1783968861 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.3
1783968861 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
4-1.4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
4-1.4.3 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
1783329793 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
1785391426 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
1783329793 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
1783326748 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
1783329793 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
1783329793 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
1783329793 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
prometheus
bookworm
2.42.0+ds-5+deb12u1
fixed
bullseye
2.24.1+ds-1
fixed
sid
3.5.3+ds1-3
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
prometheus
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
ignored
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
opentelemetry-collector
RHEL 9
0:0.152.1-1.el9_8
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
telegraf
Azure Linux 3.0
0:1.31.0-22.azl3
fixed
References