{"action":"Upgrade github.com/prometheus/prometheus to 0.311.3 or later.","affected":[{"fixed":"0.311.3","introduced":"0.45.2"}],"component":"github.com/prometheus/prometheus","cve_ids":["CVE-2026-42151"],"ecosystem":"Go","epss":0.00352,"exploited":false,"fixed_versions":["0.311.3"],"ghsa_id":"GHSA-wg65-39gg-5wfj","id":"tcs_01M5KFQQKKDJM6M5CRWDF3JP5F","modified_at":"2026-09-09T15:45:44.428200363Z","published_at":"2026-05-05T19:33:47Z","references":["https://osv.dev/vulnerability/GHSA-wg65-39gg-5wfj","https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj","https://nvd.nist.gov/vuln/detail/CVE-2026-42151","https://github.com/prometheus/prometheus/pull/18590","https://github.com/prometheus/prometheus/pull/18587","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:54427","https://access.redhat.com/errata/RHSA-2026:54288","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:50874","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:60389","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/security/cve/CVE-2026-42151","https://bugzilla.redhat.com/show_bug.cgi?id=2466507","https://github.com/prometheus/prometheus","https://github.com/prometheus/prometheus/releases/tag/v3.11.3","https://github.com/prometheus/prometheus/releases/tag/v3.5.3","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42151.json","https://access.redhat.com/errata/RHSA-2026:25039","https://access.redhat.com/errata/RHSA-2026:25245","https://access.redhat.com/errata/RHSA-2026:25504","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:37267","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40970","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47952"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-wg65-39gg-5wfj","url":"https://osv.dev/vulnerability/GHSA-wg65-39gg-5wfj"}],"summary":"Prometheus Azure AD remote write OAuth client secret exposed via config API"}