Prometheus CVE-2026-42151

Upgrade immediately to Prometheus version 3.5.3 (for 3.5.x users) or 3.11.3 (for 3.11.x users) as documented in vendor releases at https://github.com/prometheus/prometheus/releases. The patches implement type change from string to config_util.Secret for client_secret fields per PR #18587 and #18590. After patching, rotate all Azure AD OAuth client secrets exposed via the /-/config endpoint, as credentials should be considered compromised if the endpoint was accessible during the vulnerable period. Rotation procedure: (1) create new client secret in Azure AD app registration, (2) update Prometheus configuration with new secret, (3) restart Prometheus, (4) delete old secret in Azure portal. If immediate patching is not feasible, implement compensating controls: restrict network access to Prometheus /-/config endpoint via firewall rules or reverse proxy authentication (note: this adds operational complexity for legitimate debugging workflows), or disable Azure AD remote write temporarily and use alternative authentication methods like managed identities where supported (requires infrastructure changes). Monitor Azure AD sign-in logs for suspicious OAuth token requests using the exposed client ID during the exposure window. No workaround provides complete protection; patching is the only full remediation.