7.5
High
CVE-2026-42151 Prometheus is an open-source monitoring system and time series database
Description
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| prometheus 3.6 | 3.6.0 → < 3.11.3 | 3.11.3 |
| prometheus 3.5 | earliest → < 3.5.3 | 3.5.3 |
| Red Hat Hardened Images | Versions not published | |
| Custom Metric Autoscaler operator for Red Hat Openshift | Versions not published | |
| File Integrity Operator | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Network Observability Operator | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published |
Show the 76 other branches Hide the 76 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ceph Storage 5 | Versions not published | |
| Red Hat Ceph Storage 6 | Versions not published | |
| Red Hat Ceph Storage 7 | Versions not published | |
| Red Hat Ceph Storage 8 | Versions not published | |
| Red Hat Ceph Storage 9 | Versions not published | |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift distributed tracing 3 | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Multicluster Global Hub | Versions not published | |
| OpenShift Service Mesh 2 | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| RHEM 1.0 for RHEL 9 | Versions not published | |
| Red Hat Edge Manager 1.0 1783502445 | earliest → < 1783502445 | 1783502445 |
| Red Hat Trusted Artifact Signer 1.4 1783329793 | earliest → < 1783329793 | 1783329793 |
| Red Hat Edge Manager 1.1 1784127775 | earliest → < 1784127775 | 1784127775 |
| Red Hat Quay 3.9 1784125838 | earliest → < 1784125838 | 1784125838 |
| Red Hat Trusted Artifact Signer 1.3 1783968861 | earliest → < 1783968861 | 1783968861 |
| RHEM 1.1 for RHEL 10 | Versions not published | |
| RHEM 1.1 for RHEL 9 | Versions not published | |
| Multicluster Global Hub 1.4.5 1784060681 | earliest → < 1784060681 | 1784060681 |
| Red Hat Quay 3.10 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat Quay 3.16 1783955846 | earliest → < 1783955846 | 1783955846 |
| Red Hat multicluster global hub 1.4.3 1784060681 | earliest → < 1784060681 | 1784060681 |
| Red Hat Quay 3.1 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat OpenShift Container Platform 4.22 1787573491 | earliest → < 1787573491 | 1787573491 |
| Red Hat Quay 3.12 1784353904 | earliest → < 1784353904 | 1784353904 |
| Red Hat Quay 3.12 1783751865 | earliest → < 1783751865 | 1783751865 |
| Multicluster Global Hub 1.5.6 1784562060 | earliest → < 1784562060 | 1784562060 |
| Red Hat Quay 3.15 1784351966 | earliest → < 1784351966 | 1784351966 |
| Multicluster Global Hub 1.6.4 1784561376 | earliest → < 1784561376 | 1784561376 |
| Multicluster Global Hub 1.6.2 1784561376 | earliest → < 1784561376 | 1784561376 |
| Multicluster Global Hub 1.7.2 1785442872 | earliest → < 1785442872 | 1785442872 |
| Multicluster Global Hub 1.7.2 1784906628 | earliest → < 1784906628 | 1784906628 |
| Red Hat multicluster global hub 1.5.0 1784562060 | earliest → < 1784562060 | 1784562060 |
| Logging Subsystem for Red Hat OpenShift 6.2 1784747815 | earliest → < 1784747815 | 1784747815 |
| Logging for Red Hat OpenShift 6.2 1784747815 | earliest → < 1784747815 | 1784747815 |
| Multicluster Global Hub 1.5.4 1784562060 | earliest → < 1784562060 | 1784562060 |
| Multicluster Global Hub 1.7.1 1784906628 | earliest → < 1784906628 | 1784906628 |
| Red Hat multicluster global hub 1.4.4 1784060681 | earliest → < 1784060681 | 1784060681 |
| Red Hat multicluster global hub 1.6.0 1784561376 | earliest → < 1784561376 | 1784561376 |
| Logging Subsystem for Red Hat OpenShift 6.0 1785418852 | earliest → < 1785418852 | 1785418852 |
| Logging for Red Hat OpenShift 6.0 1785418852 | earliest → < 1785418852 | 1785418852 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Multicluster Global Hub 1.5.7 1784562060 | earliest → < 1784562060 | 1784562060 |
| Multicluster Global Hub 1.6.5 1784561376 | earliest → < 1784561376 | 1784561376 |
| OpenShift File Integrity Operator - FIO 1 1786439449 | earliest → < 1786439449 | 1786439449 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 1787613736 | earliest → < 1787613736 | 1787613736 |
| File Integrity Operator 1 1786439449 | earliest → < 1786439449 | 1786439449 |
| Red Hat multicluster global hub 1.4.2 1784060681 | earliest → < 1784060681 | 1784060681 |
| Compliance Operator 1 1786439449 | earliest → < 1786439449 | 1786439449 |
| Red Hat multicluster global hub 1.5.1 1784562060 | earliest → < 1784562060 | 1784562060 |
| Logging Subsystem for Red Hat OpenShift 6.5 1786645109 | earliest → < 1786645109 | 1786645109 |
| Multicluster Global Hub 1.7.0 1785442872 | earliest → < 1785442872 | 1785442872 |
| Multicluster Global Hub 1.7.0 1784906628 | earliest → < 1784906628 | 1784906628 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 1787263834 | earliest → < 1787263834 | 1787263834 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 1787222481 | earliest → < 1787222481 | 1787222481 |
| Red Hat Advanced Cluster Management for Kubernetes 2.17 1787229716 | earliest → < 1787229716 | 1787229716 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 1787689380 | earliest → < 1787689380 | 1787689380 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 1786979987 | earliest → < 1786979987 | 1786979987 |
| Red Hat OpenShift Container Platform 4.21 1787559577 | earliest → < 1787559577 | 1787559577 |
| Red Hat multicluster global hub 1.5.3 1784562060 | earliest → < 1784562060 | 1784562060 |
| Logging for Red Hat OpenShift 6 1785418852 | earliest → < 1785418852 | 1785418852 |
| Red Hat OpenShift Container Platform 4.20 1788206652 | earliest → < 1788206652 | 1788206652 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of prometheus
The 6 CVEs of prometheus →
CVE-2026-119566
Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
6.3
Medium
CVE-2026-44903
Prometheus is an open-source monitoring system and time series database
5.1
Medium
CVE-2026-42154
Prometheus is an open-source monitoring system and time series database
7.5
High
CVE-2026-40179
Prometheus is an open-source monitoring system and time series database
5.3
Medium