https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:47:00 +0000 https://db.gcve.eu/vuln/ghsa-wg65-39gg-5wfj <p><strong>Affected:</strong> Go: github.com/prometheus/prometheus</p> <p>### Impact</p> <p>Users who use Azure AD remote write with OAuth authentication are impacted.</p> <p>The `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.</p> <p>### Patches</p> <p>The problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS.</p> <p>### Workarounds</p> <p>Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.</p> <p><strong>Affected:</strong> Go: github.com/prometheus/prometheus</p> <p>### Impact</p> <p>Users who use Azure AD remote write with OAuth authentication are impacted.</p> <p>The `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.</p> <p>### Patches</p> <p>The problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS.</p> <p>### Workarounds</p> <p>Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.</p> https://db.gcve.eu/vuln/ghsa-wg65-39gg-5wfj