Prometheus Azure AD remote write OAuth client secret exposed via config API
Priority LOW 39CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 41 fixed, 11 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00352 29th percentileScored 2026-11-07
Fix Partial prometheus (prometheus): 3.5.3, 3.11.3github.com/prometheus/prometheus (Go): 0.311.3Red Hat: 64 advisoriesRed Hat: 41 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| prometheus | prometheus | before 3.5.3; 3.6.0 to before 3.11.3 | 3.5.3, 3.11.3 | Patch available | CNA |
| — | github.com/prometheus/prometheus (Go) | 0.45.2 to before 0.311.3 | 0.311.3 | Patch available | GHSA-wg65-39gg-5wfj |
- prometheus Vendorprometheus Affected before 3.5.3; 3.6.0 to before 3.11.3 Fixed in 3.5.3, 3.11.3 Patch available CNA
- github.com/prometheus/prometheus (Go) Vendor— Affected 0.45.2 to before 0.311.3 Fixed in 0.311.3 Patch available GHSA-wg65-39gg-5wfj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* | 2.48.0 to before 3.5.3; 3.6.0 to before 3.11.3 | Vulnerable | prometheus |
- cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* Versions 2.48.0 to before 3.5.3; 3.6.0 to before 3.11.3 Vulnerable ·prometheus
Remediation
- Fix · CNA prometheus (prometheus) Fixed in 3.5.3, 3.11.3
- Fix · GHSA-wg65-39gg-5wfj github.com/prometheus/prometheus (Go) Fixed in 0.311.3 Advisory →
Red Hat 64 advisories
- RHSA-2026:89715 Released 2026-10-27 · Red Hat rating ImportantOpenShift Container Platform 4.16.74 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2026:79039 Released 2026-10-15 · Red Hat rating ImportantOpenShift Container Platform 4.18.57 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9 +18
- RHSA-2026:83013 Released 2026-10-14 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.0.17
- Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
Show 61 more Red Hat advisories
- RHSA-2026:77639 Released 2026-10-07 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.4.7
- Logging Subsystem for Red Hat OpenShift 6.4 registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
- RHSA-2026:74511 Released 2026-10-01 · Red Hat rating ImportantRed Hat Quay 3.17.5
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:71447 Released 2026-09-30 · Red Hat rating ImportantOpenShift Container Platform 4.19.49 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9-operator +8
- RHSA-2026:72892 Released 2026-09-28 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.16.6 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +10
- RHSA-2026:72885 Released 2026-09-28 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.13 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/endpoint-monitoring-rhel9-operator, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +2
- RHSA-2026:70870 Released 2026-09-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.5.3
- Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:67540 Released 2026-09-15 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.12 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
- RHSA-2026:67538 Released 2026-09-15 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.11.12 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +8
- RHSA-2026:63103 Released 2026-09-08 · Red Hat rating ImportantOpenShift Container Platform 4.20.37 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-prometheus-rhel9 +1
- RHSA-2026:60441 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.22.12 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +23
- RHSA-2026:60477 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.21.31 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9 +20
- RHSA-2026:60391 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.16.4 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +19
- RHSA-2026:60390 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
- RHSA-2026:60388 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
- RHSA-2026:60389 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.15.6 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +19
- RHSA-2026:60387 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
- RHSA-2026:60386 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
- RHSA-2026:57191 Released 2026-08-19 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
- RHSA-2026:56340 Released 2026-08-18 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.5.2
- Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
- RHSA-2026:54427 Released 2026-08-12 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.15.5 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
- RHSA-2026:54288 Released 2026-08-12 · Red Hat rating ImportantOpenShift File Integrity Operator bug fix and enhancement update
- OpenShift File Integrity Operator - FIO 1 registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator
- RHSA-2026:53530 Released 2026-08-11 · Red Hat rating CriticalMulticluster Global Hub 1.7.2 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:53415 Released 2026-08-11 · Red Hat rating Importantopentelemetry-collector security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) opentelemetry-collector-0.152.1-1.el9_6
- RHSA-2026:53412 Released 2026-08-11 · Red Hat rating Importantopentelemetry-collector security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) opentelemetry-collector-0.152.1-1.el9_4
- RHSA-2026:53413 Released 2026-08-11 · Red Hat rating Importantopentelemetry-collector security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) opentelemetry-collector-0.152.1-1.el10_0
- RHSA-2026:50888 Released 2026-08-05 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:50874 Released 2026-08-05 · Red Hat rating ImportantRHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/createtree-rhel9
- RHSA-2026:50843 Released 2026-08-05 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.0.16
- Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
- RHSA-2026:49767 Released 2026-08-03 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:48771 Released 2026-07-30 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:47952 Released 2026-07-29 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.2.12
- Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
- RHSA-2026:47149 Released 2026-07-28 · Red Hat rating ImportantMulticluster Global Hub 1.7.2 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:44622 Released 2026-07-23 · Red Hat rating ImportantMulticluster Global Hub 1.6.4 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:43052 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42852 Released 2026-07-21 · Red Hat rating ImportantMulticluster Global Hub 1.5.6 security update
- Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:42796 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.15.6
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:40768 Released 2026-07-21 · Red Hat rating ImportantOpenShift Container Platform 4.22.6 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-monitoring-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +1
- RHSA-2026:42146 Released 2026-07-20 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:41066 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.16.5
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:41031 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.10.24
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:41019 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
- RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
- RHSA-2026:41030 Released 2026-07-16 · Red Hat rating ImportantMulticluster Global Hub 1.4.7 security update
- Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:40974 Released 2026-07-16 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
- RHSA-2026:40972 Released 2026-07-16 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
- RHSA-2026:40970 Released 2026-07-16 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/createtree-rhel9
- RHSA-2026:40945 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:40262 Released 2026-07-15 · Red Hat rating ImportantRed Hat Quay 3.9.24
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:40118 Released 2026-07-15 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:37276 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:37272 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
- RHSA-2026:37271 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
- RHSA-2026:37267 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/createtree-rhel9
- RHSA-2026:36796 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
- RHSA-2026:36797 Released 2026-07-08 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:36651 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
- RHSA-2026:34359 Released 2026-07-01 · Red Hat rating Importantopentelemetry-collector security update
- Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.152.1-1.el9_8
- RHSA-2026:34357 Released 2026-07-01 · Red Hat rating Importantopentelemetry-collector security update
- Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.152.1-1.el10_2
- RHSA-2026:25504 Released 2026-06-12 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images opentelemetry-collector-contrib-0.153.0-1.hum1@aarch64, opentelemetry-collector-contrib-0.153.0-1.hum1@src, opentelemetry-collector-contrib-0.153.0-1.hum1@x86_64
- RHSA-2026:25245 Released 2026-06-11 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images opentelemetry-collector-0.153.0-1.hum1@aarch64, opentelemetry-collector-0.153.0-1.hum1@src, opentelemetry-collector-0.153.0-1.hum1@x86_64
- RHSA-2026:25039 Released 2026-06-10 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images jaeger-2.19.0-1.hum1@aarch64, jaeger-2.19.0-1.hum1@src, jaeger-2.19.0-1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| File Integrity Operator | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Logging Subsystem for Red Hat OpenShift 6.0 | Fixed | RHSA-2026:50843, RHSA-2026:83013 |
| Logging Subsystem for Red Hat OpenShift 6.2 | Fixed | RHSA-2026:47952 |
| Logging Subsystem for Red Hat OpenShift 6.4 | Fixed | RHSA-2026:77639 |
| Logging Subsystem for Red Hat OpenShift 6.5 | Fixed | RHSA-2026:56340, RHSA-2026:70870 |
| Multicluster Global Hub 1.4.9 | Fixed | RHSA-2026:41030 |
| Multicluster Global Hub 1.5.8 | Fixed | RHSA-2026:42852 |
| Multicluster Global Hub 1.6.6 | Fixed | RHSA-2026:44622 |
| Multicluster Global Hub 1.7.4 | Fixed | RHSA-2026:47149, RHSA-2026:53530 |
| OpenShift File Integrity Operator - FIO 1 | Fixed | RHSA-2026:54288 |
| RHEM 1.0 for RHEL 9 | Fixed | RHSA-2026:36796 |
| RHEM 1.1 for RHEL 10 | Fixed | RHSA-2026:41019 |
| RHEM 1.1 for RHEL 9 | Fixed | RHSA-2026:41019 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 | Fixed | RHSA-2026:60387, RHSA-2026:67538 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:60390, RHSA-2026:67540, RHSA-2026:72885 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 | Fixed | RHSA-2026:60388 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 | Fixed | RHSA-2026:54427, RHSA-2026:60389 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 | Fixed | RHSA-2026:57191, RHSA-2026:60391, RHSA-2026:72892 |
| Red Hat Advanced Cluster Management for Kubernetes 2.17 | Fixed | RHSA-2026:60386 |
| Red Hat Edge Manager 1.0 | Fixed | RHSA-2026:36651 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:40118, RHSA-2026:40945 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:34357 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:34359 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:53412 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:53413 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:53415 |
| Red Hat Hardened Images | Fixed | RHSA-2026:25039, RHSA-2026:25245, RHSA-2026:25504 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:89715 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:79039 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:71447 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:63103 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:60477 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:40768, RHSA-2026:60441 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:41031 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:42146, RHSA-2026:43052 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:42796 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:41066 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:74511 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:40262 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:40970, RHSA-2026:40972, RHSA-2026:40974 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:36797, RHSA-2026:37267, RHSA-2026:37271, RHSA-2026:37272, RHSA-2026:48771, RHSA-2026:50874 |
Not affected: 55 products
- Custom Metric Autoscaler operator for Red Hat Openshift
- File Integrity Operator
- Logging Subsystem for Red Hat OpenShift 6.0
- Logging Subsystem for Red Hat OpenShift 6.2
- Logging Subsystem for Red Hat OpenShift 6.4
- Logging Subsystem for Red Hat OpenShift 6.5
- Multicluster Global Hub 1.4.9
- Multicluster Global Hub 1.5.8
- Multicluster Global Hub 1.6.6
- Multicluster Global Hub 1.7.4
- Network Observability Operator
- OpenShift File Integrity Operator - FIO 1
- OpenShift Lightspeed
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- RHEM 1.0 for RHEL 9
- RHEM 1.1 for RHEL 10
- RHEM 1.1 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- Red Hat Data Grid 8
- Red Hat Edge Manager 1.0
- Red Hat Edge Manager 1.1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenStack Platform 18.0
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
- Red Hat Trusted Artifact Signer 1.3
- Red Hat Trusted Artifact Signer 1.4
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Debezium 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42151
- 2026-10-03 Alias added: GHSA-wg65-39gg-5wfj
- 2026-10-08 Fix available: RHSA-2026:77639 · Red Hat
- 2026-10-08 Fix available: Logging Subsystem for Red Hat OpenShift 6.4 · Red Hat
- 2026-10-10 Affected versions changed · Red Hat
- 2026-10-15 Fix available: RHSA-2026:83013 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:79039 · Red Hat
- 2026-10-16 Fix available: Logging Subsystem for Red Hat OpenShift 6.0, Red Hat OpenShift Container Platform 4.18 · Red Hat
- 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.16 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:89715 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat
References
Patch 2
Advisory 2
Other 54
- https://github.com/prometheus/prometheus/releases/tag/v3.11.3
- https://github.com/prometheus/prometheus/releases/tag/v3.5.3
- https://access.redhat.com/errata/RHSA-2026:60388
- https://access.redhat.com/errata/RHSA-2026:60387
- https://access.redhat.com/errata/RHSA-2026:60386
- https://access.redhat.com/errata/RHSA-2026:57191
- https://access.redhat.com/errata/RHSA-2026:56340
- https://access.redhat.com/errata/RHSA-2026:54427
- https://access.redhat.com/errata/RHSA-2026:54288
- https://access.redhat.com/errata/RHSA-2026:53530
- https://access.redhat.com/errata/RHSA-2026:53415
- https://access.redhat.com/errata/RHSA-2026:53413
- https://access.redhat.com/errata/RHSA-2026:53412
- https://access.redhat.com/errata/RHSA-2026:50874
- https://access.redhat.com/errata/RHSA-2026:50843
- https://access.redhat.com/errata/RHSA-2026:60389
- https://access.redhat.com/errata/RHSA-2026:60390
- https://access.redhat.com/errata/RHSA-2026:60391
- https://access.redhat.com/errata/RHSA-2026:60441
- https://access.redhat.com/errata/RHSA-2026:60477
- https://access.redhat.com/errata/RHSA-2026:63103
- https://access.redhat.com/security/cve/CVE-2026-42151
- https://bugzilla.redhat.com/show_bug.cgi?id=2466507
- https://github.com/prometheus/prometheus
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42151.json
- https://access.redhat.com/errata/RHSA-2026:25039
- https://access.redhat.com/errata/RHSA-2026:25245
- https://access.redhat.com/errata/RHSA-2026:25504
- https://access.redhat.com/errata/RHSA-2026:34357
- https://access.redhat.com/errata/RHSA-2026:34359
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:37267
- https://access.redhat.com/errata/RHSA-2026:37271
- https://access.redhat.com/errata/RHSA-2026:37272
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:40768
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40970
- https://access.redhat.com/errata/RHSA-2026:40972
- https://access.redhat.com/errata/RHSA-2026:40974
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:41030
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:42146
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:42852
- https://access.redhat.com/errata/RHSA-2026:43052
- https://access.redhat.com/errata/RHSA-2026:44622
- https://access.redhat.com/errata/RHSA-2026:47149
- https://access.redhat.com/errata/RHSA-2026:47952
More Prometheus vulnerabilities
- TI-2021-10330 Arbitrary redirects under /new endpoint CVSS 3.1MEDIUM 6.5
- TI-2026-30483 Prometheus: remote read endpoint allows denial of service via crafted snappy payload CVSS 3.1HIGH 7.5
- TI-2019-02838 Cross-site scripting in [UNKNOWN] prometheus CVSS 3.0MEDIUM 6.1
- TI-2026-28993 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer CVSS 4.0MEDIUM 5.3
- TI-2026-32778 Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-42151 · CVE Program
- CVE-2026-42151 · NVD
- FIRST EPSS
- GHSA-wg65-39gg-5wfj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42151 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences