Executive brief
Prometheus exposes Azure Active Directory OAuth client secrets in plaintext through its configuration API endpoint. Any user or process with network access to the API can retrieve the sensitive credential used to authenticate with Azure AD, potentially leading to unauthorized access to cloud resources and data. Organizations using Azure AD for remote write operations must upgrade immediately to prevent credential compromise.
Technical details
The vulnerability stems from a type mismatch in Prometheus's Azure AD remote write OAuth configuration: the ClientSecret field in OAuthConfig was incorrectly typed as a plain string instead of a Secret type. Prometheus automatically redacts fields of type Secret when serving configuration via the /-/config HTTP API endpoint, but plaintext string fields are exposed unmasked. An attacker with network access to the /-/config endpoint (which requires no authentication by default) can retrieve the Azure OAuth client secret in plaintext. The fix involves changing ClientSecret from string to Secret type, which enables proper redaction in API responses. Patches are available in versions 3.11.3 and 3.5.3 LTS; users unable to upgrade can switch to Managed Identity or Workload Identity authentication methods that do not use client secrets.
Affected products
- Prometheus Prometheus >= 0.45.2, < 0.311.3
Timeline
- 2026-04-27: disclosed: Vulnerability disclosed and reviewed by GitHub
- 2026-04-27: patched: Fix available in Prometheus 3.11.3 and 3.5.3 LTS
- 2026-05-05: advisory: Published to GitHub Advisory Database
References
- https://api.github.com/users/brettgervasoni
- https://github.com/brettgervasoni
- https://api.github.com/users/brettgervasoni/gists%7B/gist_id%7D
- https://api.github.com/users/brettgervasoni/repos
- https://avatars.githubusercontent.com/u/34056000?v=4
- https://api.github.com/users/brettgervasoni/events%7B/privacy%7D