GHSA-wg65-39gg-5wfj

Dashboard / Vulnerabilities / GHSA-wg65-39gg-5wfj

GHSA-wg65-39gg-5wfj

Summary: Prometheus Azure AD remote write OAuth client secret exposed via config API

Details: ### Impact Users who use Azure AD remote write with OAuth authentication are impacted. The `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. ### Patches The problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS. ### Workarounds Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.

References: https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj, https://nvd.nist.gov/vuln/detail/CVE-2026-42151, https://github.com/prometheus/prometheus/pull/18590, https://github.com/prometheus/prometheus/pull/18587, https://access.redhat.com/errata/RHSA-2026:60387, https://access.redhat.com/errata/RHSA-2026:60386, https://access.redhat.com/errata/RHSA-2026:57191, https://access.redhat.com/errata/RHSA-2026:56340, https://access.redhat.com/errata/RHSA-2026:54427, https://access.redhat.com/errata/RHSA-2026:54288, https://access.redhat.com/errata/RHSA-2026:53530, https://access.redhat.com/errata/RHSA-2026:53415, https://access.redhat.com/errata/RHSA-2026:53413, https://access.redhat.com/errata/RHSA-2026:53412, https://access.redhat.com/errata/RHSA-2026:50874, https://access.redhat.com/errata/RHSA-2026:50843, https://access.redhat.com/errata/RHSA-2026:25039, https://access.redhat.com/errata/RHSA-2026:60388, https://access.redhat.com/errata/RHSA-2026:60389, https://access.redhat.com/errata/RHSA-2026:60390, https://access.redhat.com/errata/RHSA-2026:60391, https://access.redhat.com/errata/RHSA-2026:60441, https://access.redhat.com/errata/RHSA-2026:60477, https://access.redhat.com/security/cve/CVE-2026-42151, https://bugzilla.redhat.com/show_bug.cgi?id=2466507, https://github.com/prometheus/prometheus, https://github.com/prometheus/prometheus/releases/tag/v3.11.3, https://github.com/prometheus/prometheus/releases/tag/v3.5.3, https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42151.json, https://access.redhat.com/errata/RHSA-2026:25245, https://access.redhat.com/errata/RHSA-2026:25504, https://access.redhat.com/errata/RHSA-2026:34357, https://access.redhat.com/errata/RHSA-2026:34359, https://access.redhat.com/errata/RHSA-2026:36651, https://access.redhat.com/errata/RHSA-2026:36796, https://access.redhat.com/errata/RHSA-2026:36797, https://access.redhat.com/errata/RHSA-2026:37267, https://access.redhat.com/errata/RHSA-2026:37271, https://access.redhat.com/errata/RHSA-2026:37272, https://access.redhat.com/errata/RHSA-2026:40118, https://access.redhat.com/errata/RHSA-2026:40262, https://access.redhat.com/errata/RHSA-2026:40768, https://access.redhat.com/errata/RHSA-2026:40945, https://access.redhat.com/errata/RHSA-2026:40970, https://access.redhat.com/errata/RHSA-2026:40972, https://access.redhat.com/errata/RHSA-2026:40974, https://access.redhat.com/errata/RHSA-2026:41019, https://access.redhat.com/errata/RHSA-2026:41030, https://access.redhat.com/errata/RHSA-2026:41031, https://access.redhat.com/errata/RHSA-2026:41066, https://access.redhat.com/errata/RHSA-2026:42146, https://access.redhat.com/errata/RHSA-2026:42796, https://access.redhat.com/errata/RHSA-2026:42852, https://access.redhat.com/errata/RHSA-2026:43052, https://access.redhat.com/errata/RHSA-2026:44622, https://access.redhat.com/errata/RHSA-2026:47149, https://access.redhat.com/errata/RHSA-2026:47952