Plaintext Exposure Issue in Prometheus Monitoring System

CVE-2026-42151

What is CVE-2026-42151?

An issue was identified in the Prometheus monitoring system where the client_secret field in the Azure AD remote write OAuth configuration was incorrectly typed as a plain string. This misconfiguration allowed the Azure OAuth client secret to be exposed in plaintext through the /-/config HTTP API endpoint. Users or processes accessing this endpoint could view sensitive credentials, leading to potential unauthorized access. The vulnerability has been rectified in versions 3.5.3 and 3.11.3, which enforce appropriate restrictions on field types, ensuring sensitive data is properly protected.

References