# CVE-2026-42151: Prometheus information disclosure in Azure AD OAuth configuration

Source: https://junglewise.ai/threats/cve-2026-42151-prometheus-information-disclosure-in-azure-ad-oauth-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-42151 · Severity: high · CVSS 7.5 · Published 2026-05-04

Prometheus exposes Azure Active Directory OAuth client secrets in plaintext through its configuration API endpoint. Any user or process with network access to the API can retrieve the sensitive credential used to authenticate with Azure AD, potentially leading to unauthorized access to cloud resources and data. Organizations using Azure AD for remote write operations must upgrade immediately to prevent credential compromise.

Technologies: [github.com/prometheus/prometheus (Go)](https://junglewise.ai/threats/technologies/github-com-prometheus-prometheus), [Prometheus](https://junglewise.ai/threats/technologies/prometheus). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Prometheus](https://junglewise.ai/threats/vendors/prometheus).

## Quick answers

**Is CVE-2026-42151 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42151 being exploited in the wild.

**How severe is CVE-2026-42151?** High severity, with a CVSS score of 7.5, published 4 May 2026.

**Which products and versions are affected?** github.com/prometheus/prometheus (Go) >= 0.45.2, < 0.311.3, SEMVER:introduced=0.45.2,fixed=0.311.3; Prometheus >= 0.45.2, < 0.311.3, >= 2.48.0, < 3.5.3; >= 3.6.0, < 3.11.3.

**Is there a fix for CVE-2026-42151?** Yes. github.com/prometheus/prometheus (Go): upgrade to 0.311.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42151 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-42151?** Check whether you run github.com/prometheus/prometheus (Go) or Prometheus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/prometheus/prometheus (Go): upgrade to 0.311.3 or later

  ```sh
  go get github.com/prometheus/prometheus@v0.311.3
  ```


## Technical details

The vulnerability stems from a type mismatch in Prometheus's Azure AD remote write OAuth configuration: the ClientSecret field in OAuthConfig was incorrectly typed as a plain string instead of a Secret type. Prometheus automatically redacts fields of type Secret when serving configuration via the /-/config HTTP API endpoint, but plaintext string fields are exposed unmasked. An attacker with network access to the /-/config endpoint (which requires no authentication by default) can retrieve the Azure OAuth client secret in plaintext. The fix involves changing ClientSecret from string to Secret type, which enables proper redaction in API responses. Patches are available in versions 3.11.3 and 3.5.3 LTS; users unable to upgrade can switch to Managed Identity or Workload Identity authentication methods that do not use client secrets.

## Affected products

- Prometheus Prometheus >= 0.45.2, < 0.311.3

## Identifiers

- CVE-2026-42151
- GHSA-wg65-39gg-5wfj
- GO-2026-5710

## Timeline

- 2026-04-27: disclosed: Vulnerability disclosed and reviewed by GitHub
- 2026-04-27: patched: Fix available in Prometheus 3.11.3 and 3.5.3 LTS
- 2026-05-05: advisory: Published to GitHub Advisory Database

## References

- [https://api.github.com/users/brettgervasoni](https://api.github.com/users/brettgervasoni)
- [https://github.com/brettgervasoni](https://github.com/brettgervasoni)
- [https://api.github.com/users/brettgervasoni/gists%7B/gist_id%7D](https://api.github.com/users/brettgervasoni/gists%7B/gist_id%7D)
- [https://api.github.com/users/brettgervasoni/repos](https://api.github.com/users/brettgervasoni/repos)
- [https://avatars.githubusercontent.com/u/34056000?v=4](https://avatars.githubusercontent.com/u/34056000?v=4)
- [https://api.github.com/users/brettgervasoni/events%7B/privacy%7D](https://api.github.com/users/brettgervasoni/events%7B/privacy%7D)

## Related threats

- [Prometheus remote_write credential leak via cross-host redirects](https://junglewise.ai/threats/cve-2026-119566-prometheus-through-3-15-1-contains-a-credential-leak)
- [Prometheus stored XSS in legacy web UI heatmap chart](https://junglewise.ai/threats/cve-2026-44903-prometheus-stored-xss-in-legacy-web-ui-heatmap-chart)
- [Prometheus denial of service via memory exhaustion in remote read endpoint](https://junglewise.ai/threats/cve-2026-42154-prometheus-denial-of-service-via-memory-exhaustion-in-remote-read)
- [Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer](https://junglewise.ai/threats/cve-2026-40179-prometheus-has-stored-xss-via-metric-names-and-label-values-in)
- [Withdrawn Advisory: Prometheus XSS Vulnerability](https://junglewise.ai/threats/cve-2019-3826-withdrawn-advisory-prometheus-xss-vulnerability)