BIT-prometheus-2026-42151

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/prometheus/BIT-prometheus-2026-42151.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-prometheus-2026-42151
Aliases
Published
2026-05-06T08:50:01.473Z
Modified
2026-05-06T09:56:19.565204028Z
Summary
Prometheus Azure AD remote write OAuth client secret exposed via config API
Details

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Database specific 
{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:go:*:*"
    ]
}
References

Affected packages

Bitnami / prometheus

Package

Name
prometheus
Purl
pkg:bitnami/prometheus

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.5.3
Introduced
3.6.0
Fixed
3.11.3

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/prometheus/BIT-prometheus-2026-42151.json"