{"action":"Upgrade github.com/prometheus/prometheus to 0.311.3 or later.","affected":[{"fixed":"0.311.3","introduced":"0.45.2"}],"component":"github.com/prometheus/prometheus","cve_ids":["CVE-2026-42151"],"ecosystem":"Go","epss":0.00352,"exploited":false,"fixed_versions":["0.311.3"],"ghsa_id":"GHSA-wg65-39gg-5wfj","id":"tcs_01M5KGP9SJD6CZ1J5S3FZGAV8P","modified_at":"2026-07-15T16:27:42.071811707Z","published_at":"2026-06-25T22:34:38Z","references":["https://osv.dev/vulnerability/GO-2026-5710","https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj","https://nvd.nist.gov/vuln/detail/CVE-2026-42151","https://github.com/prometheus/prometheus/pull/18587","https://github.com/prometheus/prometheus/pull/18590","https://github.com/prometheus/prometheus/releases/tag/v3.11.3","https://github.com/prometheus/prometheus/releases/tag/v3.5.3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5710","url":"https://osv.dev/vulnerability/GO-2026-5710"}],"summary":"Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus"}