CVE-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write OAuth configuration storage/remote/azuread was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving...

io.quarkus:quarkus-amazon-lambda-http (1.10.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.10.4.final) +72 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.10.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.10.4.final -...

io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests (1.9.0), io.quarkiverse.reactivemessaging.http:quarkus-reactive-messaging-http (>=1.1.4, <=1.1.5) +227 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.8.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests 1.9.0 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (5.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (5.0.0.beta1) +104 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.14.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.14.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 5.0.0.beta1 -...

io.quarkus:quarkus-amazon-lambda-http (1.7.0.cr2), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.0.cr2) +68 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.7.0.cr2)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.0.cr2 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (4.0.6), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (4.0.6) +110 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 4.0.6 -...

io.quarkus:quarkus-amazon-lambda-http (2.7.7.final), io.quarkus:quarkus-amazon-lambda-http-deployment (2.7.7.final) +93 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.7.7.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.7.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.7.7.final -...

io.quarkus:quarkus-amazon-lambda-http (2.15.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (2.15.0.cr1) +101 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.15.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.15.0.cr1 -...

io.quarkus:quarkus-amazon-lambda-http (1.4.0.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.4.0.final) +60 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.4.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.4.0.final -...

io.quarkiverse.micrometer.registry:quarkiverse-micrometer-registry-azure-monitor (0.1.0), io.quarkiverse.micrometer.registry:quarkiverse-micrometer-registry-azure-monitor-deployment (0.1.0) +94 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.11.0.beta1)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.micrometer.registry:quarkiverse-micrometer-registry-azure-monitor 0.1.0 -...

io.quarkus:quarkus-amazon-lambda-http (2.10.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (2.10.4.final) +105 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.10.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.10.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.10.4.final -...

io.quarkus:quarkus-amazon-lambda-http (1.7.2.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.2.final) +69 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.7.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.2.final -...

io.quarkus:quarkus-amazon-lambda-http (1.11.6.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.11.6.final) +96 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.11.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.11.6.final -...

io.quarkus:quarkus-amazon-lambda-http (2.3.1.final), io.quarkus:quarkus-amazon-lambda-http-deployment (2.3.1.final) +110 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.3.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.3.1.final -...

io.quarkus:quarkus-amazon-lambda-http (1.7.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.4.final) +68 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.7.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.4.final -...

io.quarkus:quarkus-azure-functions-http (0.26.0), io.quarkus:quarkus-azure-functions-http-deployment (0.26.0) +44 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (0.26.0)

io.quarkus:quarkus-vertx-http MAVEN version 0.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-azure-functions-http 0.26.0 - io.quarkus:quarkus-azure-functions-http-deployment...

CVE-2026-31431 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp, linux-vmware, linux-aws, linux-azure...

CVE-2026-42151: Exposure of Sensitive Information to an Unauthorized Actor

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write OAuth configuration storage/remote/azuread was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving...

Prometheus information leakage vulnerability

Prometheus is an open-source software developed in the Go language, used to create real-time metric databases built using the HTTP pull model. Versions of Prometheus prior to 3.5.3 and 3.11.3 contained a vulnerability related to information leakage. This vulnerability stemmed from remote writing ...

PT-2026-36896

Name of the Vulnerable Software and Affected Versions Prometheus versions prior to 3.5.3 Prometheus versions prior to 3.11.3 Description The client secret field in the Azure AD remote write OAuth configuration storage/remote/azuread was incorrectly typed as a string instead of a Secret...