Description
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| prometheus | prometheus | < 3.5.3, >= 3.6.0, < 3.11.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | prometheus | 3.5.3+ds1-1 | — |
| Debian 13 | prometheus | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | prometheus | No fix yet | — |
| Ubuntu 25.10 | prometheus | No fix yet | — |
| Ubuntu 20.04 LTS | prometheus | No fix yet | — |
| Ubuntu 18.04 LTS | prometheus | No fix yet | — |
| Ubuntu 16.04 LTS | prometheus | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | prometheus | No fix yet | — |
| Ubuntu Pro 24.04 LTS | prometheus | No fix yet | — |
| Ubuntu Pro 22.04 LTS | prometheus | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | opentelemetry-collector | 0.152.1-1.el10_2 | RHSA-2026:34357 |
| RHEL 9 | opentelemetry-collector | 0.152.1-1.el9_8 | RHSA-2026:34359 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | opentelemetry-collector | 0.152.1-1.el10_0 | RHSA-2026:53413 |
| RHEL 9.6 EUS | opentelemetry-collector | 0.152.1-1.el9_6 | RHSA-2026:53415 |
| RHEL 9.4 E4S | opentelemetry-collector | 0.152.1-1.el9_4 | RHSA-2026:53412 |
| Red Hat Hardened Images 1 | jaeger | 2.19.0-1.hum1 | RHSA-2026:25039 |
| Red Hat Hardened Images 1 | opentelemetry-collector +1 | 0.153.0-1.hum1 | RHSA-2026:25504, RHSA-2026:25245 |
| Red Hat Edge Manager 1 | flightctl +3 | 1.0.3-1.el9em | RHSA-2026:41019, RHSA-2026:36796 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | opentelemetry-collector | 0.152.1-1.el10_2 | ALSA-2026:34357 |
| AlmaLinux 9 | opentelemetry-collector | 0.152.1-1.el9_8 | ALSA-2026:34359 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | opentelemetry-collector | 0.152.1-1.el10_2 | RLSA-2026:34357 |
| Rocky Linux 9 | opentelemetry-collector | 0.152.1-1.el9_8 | RLSA-2026:34359 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-Micro-5 | dracut-saltboot | 1.2.1-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | golang-github-prometheus-node_exporter | 1.10.2-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.12-150002.3.17.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | dracut-saltboot | 1.2.1-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-boynux-squid_exporter | 1.13.0-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150002.3.9.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-alertmanager | 0.28.1-150002.4.11.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-node_exporter | 1.10.2-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.3-150002.3.13.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.6.14+security04-150002.4.21.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.4-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-blackbox_exporter | 0.26.0-150002.3.11.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-postgres_exporter | 0.10.1-150002.3.3.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | python-defusedxml-sle15 | 0.7.1-150002.1.3.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | rhnlib | 5.2.5-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.8-150002.3.12.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.6-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | supportutils-plugin-salt | 1.2.3-150002.3.3.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | supportutils-plugin-susemanager-client | 5.2.3-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-common-libs | 5.2.5-150002.3.6.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.12-150002.3.17.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-attestation-image +3 | 5.1.4-8.22.10 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image +3 | 5.1.4-8.20.12 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-image +3 | 5.1.4-8.20.34 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image +3 | 5.1.4-8.20.13 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-postgresql-image +3 | 5.1.4-6.24.3 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-saline-image +3 | 5.1.4-9.20.24 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | uyuni-tools | 5.1.29-150700.3.26.1 | SUSE-SU-2026:2774-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-httpd-image +3 | 5.1.4-8.22.22 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image +3 | 5.1.4-9.20.25 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-squid-image +3 | 5.1.4-8.20.11 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-ssh-image +3 | 5.1.4-8.20.12 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image +3 | 5.1.4-8.20.13 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | uyuni-tools | 5.1.29-150700.3.26.1 | SUSE-SU-2026:2774-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | golang-github-prometheus-prometheus | 3.11.3-1.1 | openSUSE-SU-2026:10676-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | prometheus | 3.5.3-r0 | — |
| Alpine v3.23 | prometheus | 3.5.3-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | telegraf | 1.31.0-22 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | amazon-cloudwatch-agent | 1.300074.1-r2 | — |
| Wolfi rolling | amazon-cloudwatch-agent-operator | 3.5.0-r5 | — |
| Wolfi rolling | aws-otel-collector | 0.49.0-r0 | — |
| Wolfi rolling | certificate-transparency | 1.3.3-r22 | — |
| Wolfi rolling | certificate-transparency-trillian-ctserver | 1.3.3-r13 | — |
| Wolfi rolling | cloud-sql-proxy-2.16 | 2.16.0-r20 | — |
| Wolfi rolling | cloud-sql-proxy-2.21 | 2.21.3-r4 | — |
| Wolfi rolling | cloud-sql-proxy-2.22 | 2.22.1-r1 | — |
| Wolfi rolling | cloud-sql-proxy-2.23 | 2.23.0-r0 | — |
| Wolfi rolling | cortex +9 | No fix yet | — |
| Wolfi rolling | datadog-agent-7.77 +2 | 7.77.3-r22 | — |
| Wolfi rolling | datadog-agent-7.78 +2 | 7.78.4-r15 | — |
| Wolfi rolling | datadog-agent-7.80 +2 | 7.80.4-r5 | — |
| Wolfi rolling | fluent-bit-plugin-loki | 3.7.3-r2 | — |
| Wolfi rolling | grafana-12.4 | 12.4.10-r0 | — |
| Wolfi rolling | istio-install-cni-1.30-compat | 1.30.4-r2 | — |
| Wolfi rolling | istioctl-1.29 +1 | 1.29.3-r1 | — |
| Wolfi rolling | istioctl-1.30 +1 | 1.30.2-r1 | — |
| Wolfi rolling | jaeger-2 +1 | 2.21.0-r0 | — |
| Wolfi rolling | jaeger-2-jaeger | 2.19.0-r2 | — |
| Wolfi rolling | k8sgpt | 0.4.36-r1 | — |
| Wolfi rolling | karma | 0.130-r0 | — |
| Wolfi rolling | keda-2.19 +1 | 2.19.0-r20 | — |
| Wolfi rolling | keda-2.20 +1 | 2.20.1-r1 | — |
| Wolfi rolling | loki-3.6 +3 | 3.6.12-r1 | — |
| Wolfi rolling | mc | 0.20250813.083541-r16 | — |
| Wolfi rolling | metrics-server | 0.9.0-r0 | — |
| Wolfi rolling | metrics-server-compat | 0.9.0-r11 | — |
| Wolfi rolling | minio | 0.20260520.234452-r0 | — |
| Wolfi rolling | minio-operator +1 | 7.1.1-r28 | — |
| Wolfi rolling | minio-operator-compat | 7.1.1-r33 | — |
| Wolfi rolling | node-problem-detector-1.35 | 1.35.2-r12 | — |
| Wolfi rolling | node-problem-detector-1.36 | 1.36.0-r0 | — |
| Wolfi rolling | opentelemetry-collector | 0.156.0-r1 | — |
| Wolfi rolling | prometheus-3.11 | 3.11.3-r5 | — |
| Wolfi rolling | prometheus-3.12 | 3.12.0-r0 | — |
| Wolfi rolling | prometheus-operator +2 | 0.92.1-r2 | — |
| Wolfi rolling | prometheus-operator-iamguarded-compat | 0.94.0-r0 | — |
| Wolfi rolling | prometheus-pushgateway | 1.11.3-r2 | — |
| Wolfi rolling | tempo-2.10 +2 | 2.10.7-r3 | — |
| Wolfi rolling | trillian-logserver +1 | 1.7.3-r10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/prometheus/prometheus | >= 0.45.2, < 0.311.3 | 0.311.3 | GHSA-wg65-39gg-5wfj |
Advisories 20
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-1292 Prometheus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:34359 Important: opentelemetry-collector security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:34357 Important: opentelemetry-collector security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:53415 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53413 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53412 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:41019 Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:36796 Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34359 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34357 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:25039 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:25504 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:25245 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- RLSA-2026:34357 Important: opentelemetry-collector security update Rocky Linux Security Advisories · Jul 7, 2026
- SUSE-SU-2026:2774-1 Security update 5.1.4 for Multi-Linux Manager Server SUSE / openSUSE Security Updates · Jul 7, 2026
- SUSE-SU-2026:2768-1 Security update 5.1.4 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Jul 7, 2026
- RLSA-2026:34359 Important: opentelemetry-collector security update Rocky Linux Security Advisories · Jul 5, 2026
- openSUSE-SU-2026:10676-1 golang-github-prometheus-prometheus-3.11.3-1.1 on GA media SUSE / openSUSE Security Updates · May 5, 2026
References
- https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj
- https://github.com/prometheus/prometheus/pull/18587
- https://github.com/prometheus/prometheus/pull/18590
- https://github.com/prometheus/prometheus/releases/tag/v3.11.3
- https://github.com/prometheus/prometheus/releases/tag/v3.5.3