Prometheus, an open-source monitoring system, had a vulnerability (CVE-2026-42151) where the Azure AD remote write OAuth client_secret was exposed in plaintext through the /-/config HTTP API endpoint. This was due to the client_secret field being typed as a string instead of a Secret type, which bypassed Prometheus's redaction mechanism for sensitive fields. The exposure allowed any user or process with access to the configuration API endpoint to retrieve the OAuth client secret. The vulnerability affects Prometheus versions prior to 3.5.3 and versions from 3.6.0 up to but not including 3.11.3. The issue has been patched in versions 3.5.3 and 3.11.3.

The vulnerability allows unauthorized disclosure of the Azure AD OAuth client secret in plaintext to any user or process with access to the Prometheus /-/config HTTP API endpoint. This could lead to compromise of OAuth credentials used for remote write operations, potentially enabling unauthorized access or actions within Azure AD contexts configured in Prometheus.

A fix is available in Prometheus versions 3.5.3 and 3.11.3. Users should upgrade affected Prometheus instances to at least version 3.5.3 or 3.11.3 to remediate this vulnerability. There is no indication of alternative mitigations or that the issue is already mitigated without upgrading.