https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:34:27.783111+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:34357 ALSA-2026:34357 — Important: opentelemetry-collector security update 2026-10-02T11:34:28.945560+00:00

Affected: AlmaLinux:10: opentelemetry-collector

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bit-prometheus-2026-42151 BIT-prometheus-2026-42151 — Prometheus Azure AD remote write OAuth client secret exposed via config API 2026-10-02T11:34:28.945680+00:00

Affected: Bitnami: prometheus

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-ap95632 Withdrawn: CLEANSTART-2026-AP95632 — Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-… 2026-10-02T11:34:28.945726+00:00

Withdrawn by the publisher.

Affected: CleanStart: keda-fips

Multiple security vulnerabilities affect the keda-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-366101 EUVD-2026-366101 2026-10-02T11:34:28.945774+00:00 EUVD-2026-366101 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42151 fkie_cve-2026-42151 2026-10-02T11:34:28.945794+00:00

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

 https://cve.radiocsirt.org/vuln/ghsa-wg65-39gg-5wfj GHSA-wg65-39gg-5wfj — Prometheus Azure AD remote write OAuth client secret exposed via config API 2026-10-02T11:34:28.945844+00:00

Affected: Go: github.com/prometheus/prometheus

### Impact

Users who use Azure AD remote write with OAuth authentication are impacted.

The `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.

### Patches

The problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS.

### Workarounds

Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-42151 msrc_CVE-2026-42151 — Prometheus Azure AD remote write OAuth client secret exposed via config API 2026-10-02T11:34:28.945875+00:00 msrc_CVE-2026-42151 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10676-1 openSUSE-SU-2026:10676-1 — golang-github-prometheus-prometheus-3.11.3-1.1 on GA media 2026-10-02T11:34:28.945893+00:00

golang-github-prometheus-prometheus-3.11.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:25039 RHSA-2026:25039 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T11:34:28.945909+00:00

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression python-idna: idna: Denial of Service via specially crafted long inputs joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads

 https://cve.radiocsirt.org/vuln/rlsa-2026:34357 RLSA-2026:34357 — Important: opentelemetry-collector security update 2026-10-02T11:34:28.945934+00:00

Affected: Rocky Linux:10: opentelemetry-collector

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

* github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:2774-1 SUSE-SU-2026:2774-1 — Security update 5.1.4 for Multi-Linux Manager Server 2026-10-02T11:34:28.945963+00:00

Security update 5.1.4 for Multi-Linux Manager Server

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42151 UBUNTU-CVE-2026-42151 2026-10-02T11:34:28.945986+00:00

Affected: Ubuntu:16.04:LTS: prometheus, Ubuntu:18.04:LTS: prometheus, Ubuntu:20.04:LTS: prometheus, Ubuntu:Pro:22.04:LTS: prometheus, Ubuntu:Pro:24.04:LTS: prometheus, Ubuntu:25.10: prometheus, Ubuntu:Pro:26.04:LTS: prometheus

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1292 WID-SEC-W-2026-1292 — Prometheus: Mehrere Schwachstellen 2026-10-02T11:34:28.946015+00:00

Ein Angreifer kann mehrere Schwachstellen in Prometheus ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.