GHSA-WG65-39GG-5WFJ高危已审查

Prometheus Azure AD remote write OAuth client secret exposed via config API

OSV 1.4.0 · github-reviewed · 修改于 2026-09-01 23:30

发布时间

2026-05-06 03:33

GitHub 审查时间

2026-05-06 03:33

NVD 发布时间

2026-05-05 03:16

源文件

advisories/github-reviewed/2026/05/GHSA-wg65-39gg-5wfj/GHSA-wg65-39gg-5wfj.json

公告说明

Impact

Users who use Azure AD remote write with OAuth authentication are impacted.

The client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.

Patches

The problem has been patched by changing ClientSecret in OAuthConfig to Secret. Users should upgrade to 3.11.3 or 3.5.3 LTS.

Workarounds

Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.

受影响的软件包

github.com/prometheus/prometheus

标识信息

别名 / CVE

CVE-2026-42151

CWE

CWE-200CWE-256CWE-312

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-wg65-39gg-5wfj",
  "aliases": [
    "CVE-2026-42151"
  ],
  "details": "### Impact\n\nUsers who use Azure AD remote write with OAuth authentication are impacted.\n\nThe `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.\n\n### Patches\n\nThe problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS.\n\n### Workarounds\n\nUsers  who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.",
  "summary": "Prometheus Azure AD remote write OAuth client secret exposed via config API",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0.45.2"
            },
            {
              "fixed": "0.311.3"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/prometheus/prometheus",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2026-09-01T15:30:39Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2026-05-05T19:33:47Z",
  "references": [
    {
      "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/prometheus/prometheus/pull/18590",
      "type": "WEB"
    },
    {
      "url": "https://github.com/prometheus/prometheus/pull/18587",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60387",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60386",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:57191",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:56340",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:54427",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:54288",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53530",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53415",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53413",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53412",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:50874",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:50843",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:25039",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60388",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60389",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60390",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60391",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60441",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60477",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-42151",
      "type": "WEB"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507",
      "type": "WEB"
    },
    {
      "url": "https://github.com/prometheus/prometheus",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
      "type": "WEB"
    },
    {
      "url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
      "type": "WEB"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42151.json",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:25245",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:25504",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:34357",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:34359",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:36651",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:36796",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:36797",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:37267",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:37271",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:37272",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:40118",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:40262",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:40768",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:40945",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:40970",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:40972",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:40974",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:41019",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:41030",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:41031",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:41066",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:42146",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:42796",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:42852",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:43052",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:44622",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:47149",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:47952",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-256",
      "CWE-312"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2026-05-04T19:16:04Z",
    "github_reviewed_at": "2026-05-05T19:33:47Z"
  }
}