Prometheus OAuth Client Secret Exposure via /-/config (pre 3.5.3/3.11.3)
CVE-2026-42151 Published on May 4, 2026

Prometheus Azure AD remote write OAuth client secret exposed via config API
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-42151 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

NONE

Availability Impact:

NONE

Weakness Types

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2026-42151 has been classified to as an Information Disclosure vulnerability or weakness.

Cleartext Storage of Sensitive Information

The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. Because the information is stored in cleartext, attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Unprotected Storage of Credentials

Storing a password in plaintext may result in a system compromise. Password management issues occur when a password is stored in plaintext in an application's properties or configuration file. Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource.

Products Associated with CVE-2026-42151

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-42151 are published in these products:

Prometheus

Red Hat Hummingbird

Red Hat Openshift Custom Metrics Autoscaler

Red Hat Openshift File Integrity Operator

Red Hat Logging

Red Hat Network Observ Optr

Red Hat Openshift Lightspeed

Red Hat Acm

Red Hat Ceph Storage

Red Hat Edge Manager

Red Hat Enterprise Linux (RHEL)

Red Hat Openshift Ai

Red Hat Openshift

Red Hat Openshift Distributed Tracing

Red Hat Openshift Gitops

Red Hat Openstack

Red Hat Quay

Red Hat Trusted Artifact Signer

Red Hat Multicluster Globalhub

Red Hat Service Mesh

Red Hat Enterprise Linux Eus

Red Hat Rhel E4s

Red Hat Rhel Eus

Affected Versions

prometheus:

Version < 3.5.3 is affected.
Version >= 3.6.0, < 3.11.3 is affected.

Red Hat Enterprise Linux 10:

Version 0:0.152.1-1.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:0.152.1-1.el10_0 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:0.152.1-1.el9_8 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions:

Version 0:0.152.1-1.el9_4 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:0.152.1-1.el9_6 and below * is unaffected.

Red Hat RHEM 1.0 for RHEL 9:

Version 0:1.0.3-1.el9em and below * is unaffected.

Red Hat RHEM 1.1 for RHEL 10:

Version 0:1.1.3-1.el10em and below * is unaffected.

Red Hat RHEM 1.1 for RHEL 9:

Version 0:1.1.3-1.el9em and below * is unaffected.

Logging for Red Hat OpenShift 6:

Version 1785418915 and below * is unaffected.

Logging for Red Hat OpenShift 6:

Version 1785418855 and below * is unaffected.

Logging for Red Hat OpenShift 6:

Version 1785418852 and below * is unaffected.

Logging for Red Hat OpenShift 6.2:

Version 1784747884 and below * is unaffected.

Logging for Red Hat OpenShift 6.2:

Version 1784747816 and below * is unaffected.

Logging for Red Hat OpenShift 6.2:

Version 1784747815 and below * is unaffected.

Logging Subsystem for Red Hat OpenShift 6.5:

Version 1786645138 and below * is unaffected.

Logging Subsystem for Red Hat OpenShift 6.5:

Version 1786645114 and below * is unaffected.

Logging Subsystem for Red Hat OpenShift 6.5:

Version 1786645109 and below * is unaffected.

Red Hat Multicluster Global Hub 1.4.5:

Version 1784060681 and below * is unaffected.

Red Hat Multicluster Global Hub 1.6.5:

Version 1784561376 and below * is unaffected.

Red Hat Multicluster Global Hub 1.7.0:

Version 1784906628 and below * is unaffected.
Version 1785442872 and below * is unaffected.

Red Hat OpenShift File Integrity Operator - FIO 1:

Version 1786439449 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1787260378 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1787682942 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1787681481 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1787686252 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1787295886 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1787295854 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1787261499 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1787689380 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.13:

Version 1787259108 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.13:

Version 1787263765 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.13:

Version 1787263795 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.13:

Version 1787259314 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.13:

Version 1787259281 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.13:

Version 1787259294 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.13:

Version 1787263757 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.13:

Version 1787263834 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1787645355 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1786979861 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1786976960 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1786979923 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1787147639 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1787147659 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1787147625 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1787147638 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1786976997 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1787147621 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1786979987 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.15:

Version 1786547818 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.15:

Version 1786547849 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.15:

Version 1786547911 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.15:

Version 1787238569 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.15:

Version 1787613736 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1786909114 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1786909099 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1786908350 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1786908427 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1786909036 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1787645431 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1787222491 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1787222490 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1787233432 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1787222481 and below * is unaffected.