CVE-2026-42151: 
Grafana vulnerability analysis and mitigation

CVE-2026-42151 is a credential disclosure vulnerability in Prometheus, an open-source monitoring system and time series database, where the Azure AD remote write OAuth client_secret is exposed in plaintext via the /-/config HTTP API endpoint. The vulnerability affects Prometheus versions >= 2.48.0 and < 3.5.3, and >= 3.6.0 and < 3.11.3. It was reported by Brett Gervasoni and disclosed on April 27, 2026, with patches released the same day. The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory).

The root cause is a type misconfiguration (CWE-200, CWE-312): the ClientSecret field in the OAuthConfig struct within storage/remote/azuread was declared as a plain string type rather than config_util.Secret. Prometheus's configuration redaction mechanism only masks fields explicitly typed as Secret, so the Azure OAuth client secret was served in cleartext to any caller of the /-/config HTTP API endpoint. No authentication is required to access this endpoint by default, making the attack vector network-accessible with low complexity and no privileges required. The fix, applied in PRs #18587 and #18590, changes ClientSecret to config_util.Secret so it is redacted as <secret> in API responses (GitHub Advisory, PR #18587, PR #18590).

Successful exploitation allows any unauthenticated attacker with network access to the Prometheus /-/config endpoint to retrieve the plaintext Azure AD OAuth client_secret. With this credential, an attacker can authenticate to Azure Active Directory as the Prometheus application and access any Azure resources that application is authorized to reach, potentially enabling lateral movement within the victim's Azure environment, data exfiltration, or further privilege escalation depending on the permissions granted to the service principal (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.01% (0.000100), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite the low exploitation probability, the trivial nature of the attack — a simple unauthenticated HTTP GET request — makes it accessible to any attacker with network reach to the endpoint (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or internally accessible Prometheus instances running versions >= 2.48.0 and < 3.5.3, or >= 3.6.0 and < 3.11.3, using network scanning tools (e.g., Shodan, Censys, or nmap targeting default Prometheus port 9090).
2. Verify Azure AD configuration: Confirm the target Prometheus instance uses Azure AD remote write with OAuth by checking for relevant configuration indicators (e.g., service name, scrape targets).
3. Request the config endpoint: Send an unauthenticated HTTP GET request to the Prometheus configuration API:

   GET http://<prometheus-host>:9090/-/config

4. Extract the client secret: Parse the returned YAML configuration for the azuread remote write section and extract the plaintext value of the client_secret field.
5. Abuse the credential: Use the extracted client_id and client_secret to authenticate against Azure AD (e.g., via az login --service-principal or direct OAuth token requests) and access Azure resources permitted to the Prometheus service principal (GitHub Advisory, PR #18590).

• Network: Unexpected or anomalous HTTP GET requests to /-/config endpoint on Prometheus instances (port 9090 by default), especially from external or untrusted IP addresses.
• Logs: Prometheus access logs showing requests to /-/config from unusual source IPs or at unusual times; repeated access from automated tools or scripts.
• Azure AD: Unexpected Azure AD sign-in events or token issuance for the Prometheus service principal from unfamiliar IP addresses or geographic locations; unusual API calls to Azure resources by the Prometheus application identity.
• Network: Outbound OAuth token requests to https://login.microsoftonline.com originating from hosts other than the Prometheus server.

Upgrade Prometheus to version 3.5.3 (LTS) or 3.11.3 (or later), which fix the issue by changing ClientSecret to config_util.Secret so it is redacted in API responses (v3.5.3 Release, v3.11.3 Release). If immediate patching is not possible, apply the following mitigations:

• Switch authentication method: Migrate Azure AD remote write authentication to Managed Identity or Workload Identity, which do not use a client_secret.
• Restrict endpoint access: Use firewall rules, reverse proxy authentication, or network policies to block unauthenticated access to the /-/config HTTP API endpoint.
• Rotate credentials: If the /-/config endpoint was accessible to untrusted networks, immediately rotate the Azure AD OAuth client secret and audit Azure AD sign-in logs for unauthorized access (GitHub Advisory).

The vulnerability was responsibly disclosed by Brett Gervasoni and acknowledged in the Prometheus v3.11.3 and v3.5.3 release notes (v3.11.3 Release). SUSE issued security update announcements (SUSE-SU-2026:2243-1 and SUSE-SU-2026:2267-1) addressing this CVE in their Prometheus packages. The issue received coverage on security aggregation platforms and social media, including Mastodon and Bluesky, though no major controversy or widespread alarm was noted given the availability of patches on the same day as disclosure.