Most recent entries from all

ALSA-2026:34357 — Important: opentelemetry-collector security update

Affected: AlmaLinux:10: opentelemetry-collector

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BIT-prometheus-2026-42151 — Prometheus Azure AD remote write OAuth client secret exposed via config API

Affected: Bitnami: prometheus

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Withdrawn: CLEANSTART-2026-AP95632 — Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: keda-fips

Multiple security vulnerabilities affect the keda-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-366101

fkie_cve-2026-42151

GHSA-wg65-39gg-5wfj — Prometheus Azure AD remote write OAuth client secret exposed via config API

Affected: Go: github.com/prometheus/prometheus

### Impact

Users who use Azure AD remote write with OAuth authentication are impacted.

The `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.

### Patches

The problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS.

### Workarounds

Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.

msrc_CVE-2026-42151 — Prometheus Azure AD remote write OAuth client secret exposed via config API

msrc_CVE-2026-42151

openSUSE-SU-2026:10676-1 — golang-github-prometheus-prometheus-3.11.3-1.1 on GA media

golang-github-prometheus-prometheus-3.11.3-1.1 on GA media

RHSA-2026:25039 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression python-idna: idna: Denial of Service via specially crafted long inputs joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads

RLSA-2026:34357 — Important: opentelemetry-collector security update

Affected: Rocky Linux:10: opentelemetry-collector

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

* github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:2774-1 — Security update 5.1.4 for Multi-Linux Manager Server

Security update 5.1.4 for Multi-Linux Manager Server

UBUNTU-CVE-2026-42151

Affected: Ubuntu:16.04:LTS: prometheus, Ubuntu:18.04:LTS: prometheus, Ubuntu:20.04:LTS: prometheus, Ubuntu:Pro:22.04:LTS: prometheus, Ubuntu:Pro:24.04:LTS: prometheus, Ubuntu:25.10: prometheus, Ubuntu:Pro:26.04:LTS: prometheus

WID-SEC-W-2026-1292 — Prometheus: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Prometheus ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.