Every CVE Search/ Get API key

CVE-2026-42151

Prometheus Azure AD remote write OAuth client secret exposed via config API

7.5 HighFix available

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.35%Up 0.3 points since May 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Prometheus Azure AD remote write OAuth client secret exposed via config API

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Record
CVE-2026-42151
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-312, CWE-256
Updated
2026-11-02
EUVDEUVD-2026-27089 7.5

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Record
EUVD-2026-27089
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wg65-39gg-5wfj 7.5

Prometheus Azure AD remote write OAuth client secret exposed via config API

Impact

Users who use Azure AD remote write with OAuth authentication are impacted.

The client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.

Patches

The problem has been patched by changing ClientSecret in OAuthConfig to Secret. Users should upgrade to 3.11.3 or 3.5.3 LTS.

Workarounds

Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.

Record
GHSA-wg65-39gg-5wfj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-256, CWE-312
Updated
2026-11-02
NVD 7.5

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Record
CVE-2026-42151
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-312, CWE-256
Updated
2026-11-02
OSVALPINE-CVE-2026-42151 7.5

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Record
ALPINE-CVE-2026-42151
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSV 7.5

Prometheus Azure AD remote write OAuth client secret exposed via config API

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Record
CVE-2026-42151
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-312
Updated
2026-11-02
Show 27 moreShow less
OSVDEBIAN-CVE-2026-42151 7.5

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Record
DEBIAN-CVE-2026-42151
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-wg65-39gg-5wfj 7.5

Prometheus Azure AD remote write OAuth client secret exposed via config API

Impact

Users who use Azure AD remote write with OAuth authentication are impacted.

The client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.

Patches

The problem has been patched by changing ClientSecret in OAuthConfig to Secret. Users should upgrade to 3.11.3 or 3.5.3 LTS.

Workarounds

Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.

Record
GHSA-wg65-39gg-5wfj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-256, CWE-312
Updated
2026-11-02
OSVRHSA-2026:25039 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:25039
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25245 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:25245
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25504 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:25504
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:34357 8.2

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:34357
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:34359 8.2

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:34359
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:36796 9.1

Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update

Record
RHSA-2026:36796
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:41019 9.1

Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update

Record
RHSA-2026:41019
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:53412 8.6

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:53412
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:53413 8.6

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:53413
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:53415 8.6

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:53415
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:34357 8.2

Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

  • github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

  • github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

  • net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:34357
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:34359 8.2

Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

  • github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

  • github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

  • net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:34359
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVROOT-APP-GOBINARY-CVE-2026-42151 7.5

CVE-2026-42151 in github.com/prometheus/prometheus - Patched by Root

Root has patched CVE-2026-42151 in the github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available.

Record
ROOT-APP-GOBINARY-CVE-2026-42151
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42151 7.5

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Record
UBUNTU-CVE-2026-42151
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:34357 No score

Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

  • github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)
  • github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
  • net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:34357
Updated
2026-11-02
OSVALSA-2026:34359 No score

Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

  • github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)
  • github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
  • net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:34359
Updated
2026-11-02
OSVAZL-86610 No score

CVE-2026-42151 affecting package telegraf for versions less than 1.31.0-22

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Record
AZL-86610
Updated
2026-11-05
OSVBIT-prometheus-2026-42151 No score

Prometheus Azure AD remote write OAuth client secret exposed via config API

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Record
BIT-prometheus-2026-42151
Updated
2026-11-02
OSVGO-2026-5710 No score

Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Record
GO-2026-5710
Updated
2026-11-02
OSVopenSUSE-SU-2026:10676-1 No score

golang-github-prometheus-prometheus-3.11.3-1.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-3.11.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10676-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
  • GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
  • GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
  • GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
  • GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
  • GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
  • GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
  • GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
  • GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
  • GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
  • GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
  • GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
  • GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
  • GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
  • GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
  • GO-2026-5933 GHSA-3g4q-2f67-2gvh
  • GO-2026-5934 GHSA-59qp-cfj3-rp64
  • GO-2026-5935 GHSA-7856-g3gv-9wq8
  • GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
  • GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
  • GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
  • GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
  • GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
  • GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
  • GO-2026-5942 CVE-2026-46600
  • GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
  • GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
  • GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
  • GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
  • GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
  • GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
  • GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
  • GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
  • GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
  • GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
  • GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
  • GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
  • GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
  • GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
  • GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
  • GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
  • GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
  • GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
  • GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
  • GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
  • GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
  • GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
  • GO-2026-5969 GHSA-g936-7jqj-mwv8
  • GO-2026-5970 CVE-2026-56852
  • GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
  • GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
  • GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
  • GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
  • GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
  • GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
  • GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
  • GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
  • GO-2026-5981 GHSA-mqxv-9rm6-w8qc
  • GO-2026-5982 GHSA-pqg7-v6wh-3pfp
  • GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
  • GO-2026-5985 GHSA-7rx3-5wx3-5v76
  • GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
  • GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
  • GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
  • GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
  • GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
  • GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
  • GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
  • GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
  • GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
  • GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
  • GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
  • GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
  • GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
  • GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
  • GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
  • GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
Record
openSUSE-SU-2026:21483-1
Updated
2026-11-02
OSVSUSE-SU-2026:2243-1 No score

Security update 5.0.8 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

  • Security Fixes:

    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)

golang-github-prometheus-node_exporter:

  • Backward Compatibility and packaging changes:

    • Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
    • Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility

  • Version 1.10.2:

    • Fixed typo in Zswap metric name (meminfo)

  • Version 1.10.1:

    • Fixed mount points being collected multiple times (filesystem)
    • Refactored mountinfo parsing (bsc#1261810)
    • Added Zswap/Zswapped metrics (meminfo)

  • Version 1.10.0:

    • New collectors: PCIe devices, swaps
    • Added systemd virtualization metrics, AIX metrics
    • WiFi packet metrics, additional PCIe and TLB metrics
    • Changed mdadm to use sysfs, added erofs to excluded filesystems
    • Fixed bugs: cpufreq collector, ethtool metrics

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987).
    • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
      • Bump google.golang.org/grpc to version 1.79.3
    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      • Bump rollup to version 4.59.0

  • Other changes:

    • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit.
    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)

prometheus-postgres_exporter:

  • Security Fixes:

    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987)
    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)

  • Highlights of other changes and bug fixes:

    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy

grafana was updated from version 11.6.11 to 11.6.14+security01:

  • Security Fixes:

    • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Highlights of other changes and bug fixes:

    • Version 11.6.13:

      • Wire the public dashboard service to the HTTP server

    • Version 11.6.12:

      • Update authentication redirect logic
      • Fixed single panel render with variable references

spacecmd:

  • Version…
Record
SUSE-SU-2026:2243-1
Updated
2026-11-02
OSVSUSE-SU-2026:2265-1 No score

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:

This is a codestream only update

Record
SUSE-SU-2026:2265-1
Updated
2026-11-02
OSVSUSE-SU-2026:2768-1 No score

Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues:

dracut-saltboot updated to version 1.2.1:

  • Key Update Highlights (v1.2.1)
    • Added wait check for minion start (default 10s), configurable using rd.saltboot.salt_start_timeout option (bsc#1260870)
    • Decouple salt key wait check to use separate configurable option rd.saltboot.salt_key_timeout, with default 60s
    • Introduce rd.saltboot namespace for all options, mark old as deprecated

golang-github-QubitProducts-exporter_exporter:

  • Security issues fixed:
    • CVE-2022-21698: Fixed prometheus/client_golang possible denial of service using InstrumentHandlerCounter (bsc#1248699)

golang-github-boynux-squid_exporter:

  • Non customer facing changes

golang-github-lusitaniae-apache_exporter:

  • Non customer facing changes

golang-github-prometheus-alertmanager:

  • Non customer facing changes

golang-github-prometheus-node_exporter updated to version 1.10.2:

  • Key Update Highlights (v1.10.0 to v1.10.2):
    • New Collectors: Added new collectors for PCIe devices and swaps.
    • New Metrics: Introduced metrics for Zswap/Zswapped, Systemd Virtualization, and WiFi packets (received/transmitted)
    • Bug Fixes: Resolved a duplicate collection bug in filesystem mount points, fixed a Zswap metric typo, and patched a logging race condition in systemd.
    • Changes: Switched mdadm to use sysfs for RAID metrics, and added erofs to the default excluded filesystems list.
    • Internal Refactoring: filesystem mountinfo parsing refactor (bsc#1261810)

golang-github-prometheus-prometheus updated to version 3.5.3:

  • Security issues fixed:

    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (v3.5.3) (bsc#1263986)
    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the limit (v3.5.3) (bsc#1263987)
    • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (v3.5.2) (bsc#1262222).
    • CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (backported patch) (bsc#1266608)

  • Other changes:

    • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (v3.5.3)
    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)
    • Internal update with non customer facing changes (v3.5.1)

grafana updated to version 11.6.14+security-04:

  • Security issues fixed in v11.6.14+security-04:
    • CVE-2026-28374: Fixed insecure direct object reference in Annotations API (bsc#1265290)
    • CVE-2026-28376: Fixed unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
    • CVE-2026-28383: Fixed unbounded memory allocation in Grafana plugin resources (bsc#1265286)
    • CVE-2026-28380: Fixed broken access control in Snapshot API (bsc#1265287)
    • CVE-2026-33376: Fixed Auth Proxy IPv6 whitelist bypass (bsc#1265285)
    • CVE-2026-28379: Fixed viewer-triggered race condition in Grafana Live (bsc#1265288)
    • CVE-2026-33377: Fixed dashboard Editor Privilege Escalation (bsc#1265284)
    • CVE-2026-33378: Fixed OOM exception in Grafana Data Source Plugin (bsc#1265283)
    • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
    • CVE-2026-33380: Fixed vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)
  • Security issues fixed through backported patches:
    • CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)
    • CVE-2026-34986: Fixed panic in JWE decryption (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Fixed multiple issues when…
Record
SUSE-SU-2026:2768-1
Updated
2026-11-02
OSVSUSE-SU-2026:2774-1 No score

Security update 5.1.4 for Multi-Linux Manager Server

This update fixes the following issues:

Release Notes Highlights:

  • Update to SUSE Multi-Linux Manager 5.1.4
    • Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions
    • Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0
    • SUSE Liberty Linux 9.6 Support
    • New API Endpoint - listMigrationTargetsWithChannels
    • Debian 12 End-of-Life Notice
    • SUSE Registry URL Change
    • Security fixes: CVE-2026-34986, CVE-2026-41602, CVE-2026-39821, CVE-2026-42198 CVE-2022-21698, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154 CVE-2026-28374, CVE-2026-28376, CVE-2026-28379, CVE-2026-28380 CVE-2026-28383, CVE-2026-33376, CVE-2026-33377, CVE-2026-33378 CVE-2026-33380, CVE-2026-33381
    • Bugs mentioned: bsc#1226578, bsc#1234567, bsc#1238890, bsc#1242916, bsc#1245107 bsc#1247707, bsc#1248699, bsc#1249243, bsc#1253032, bsc#1257583 bsc#1257894, bsc#1258041, bsc#1258079, bsc#1258144, bsc#1258382 bsc#1258816, bsc#1259087, bsc#1259230, bsc#1259261, bsc#1259474 bsc#1259479, bsc#1259482, bsc#1259521, bsc#1259590, bsc#1259591 bsc#1259700, bsc#1259739, bsc#1259787, bsc#1259960, bsc#1260031 bsc#1260614, bsc#1260806, bsc#1261305, bsc#1261307, bsc#1261327 bsc#1261631, bsc#1261723, bsc#1261753, bsc#1261841, bsc#1261902 bsc#1262090, bsc#1262285, bsc#1262460, bsc#1262471, bsc#1262492 bsc#1262595, bsc#1262708, bsc#1262720, bsc#1262761, bsc#1263814 bsc#1263841, bsc#1264149, bsc#1264234, bsc#1264256, bsc#1264966 bsc#1265134, bsc#1265319, bsc#1265358, bsc#1265975, bsc#1266012 bsc#1262950, bsc#1263501, bsc#1266600, bsc#1266556, bsc#1264174 bsc#1262222, bsc#1263986, bsc#1263987, bsc#1265290, bsc#1265289 bsc#1265288, bsc#1265287, bsc#1265286, bsc#1265285, bsc#1265284 bsc#1265283, bsc#1265282, bsc#1265281, bsc#1269253, bsc#1269534

Container images and uyuni-tools changes:

server-attestation-image:

  • Version 5.1.15
    • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-hub-xmlrpc-api-image:

  • Version 5.1.14
    • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-image:

  • Version 5.1.15
    • Healthcheck on disk usage based on taskomatic (bsc#1238890)
    • Added mozilla-nss-sysinit to Dockerfile required for FIPS (bsc#1247707)
    • Do not get repositories from SCC in the server container (bsc#1242916)
    • Added 'susemanager-tools', 'susemanager' and 'susemanager-tools-salt' packages to server-image

server-migration-14-16-image:

  • Version 5.1.14
    • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-postgresql-image:

  • Version 5.1.13
    • Healthcheck on disk usage based on taskomatic (bsc#1238890)
    • Added needed pg_hba rules on upgrade (bsc#1262492, bsc#1264149)

server-saline-image:

  • Version 5.1.14
    • Use python3*-tornado6 package to make it working with Python 3.11

uyuni-tools:

  • Version 5.1.29-0 Check backup status only after database is started (bsc#1262492)
  • Version 5.1.28-0
    • Remove waitForTraefik function (bsc#1261902)
    • Fix inspect: missing registry for db image (bsc#1259739)
    • Preserve hub replicas during upgrade (bsc#1262708)
    • Stop automatically unhealthy container
    • Ignore spacewalk-service stop return code.
    • Use correct CA for Report DB (bsc#1260806)
    • Do not call podman healthcheck run to wait for pods to be ready (bsc#1266012)

The following packages are underlying build dependencies and system components used by the containers:

cobbler:

  • Added the distro signature for rhel10 (bsc#1265134)

liberate-formula:

  • Version 0.1.4
    • No customer facing changes
  • Version 0.1.3
    • Liberate formula support for EL10 (bsc#1265975)

prometheus-exporters-formula:

  • Version 1.4.3
    • Added support for Python 3.13
    • Drop migrate_formula_data script as it is obsolete

prometheus-postgres_exporter:

-…

Record
SUSE-SU-2026:2774-1
Updated
2026-11-02

Affected products

Show 43 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
github.com/prometheus/prometheus
Go
 0.45.2 up to 0.311.3
0.311.3
prometheus
Alpine:v3.23
 2.48.0 up to 3.5.3-r0
3.5.3-r0
prometheus
Alpine:v3.24
 2.48.0 up to 3.5.3-r0
3.5.3-r0
opentelemetry-collector
AlmaLinux:10
From an advisory covering 6 CVEs
 before 0.152.1-1.el10_2
0.152.1-1.el10_2
opentelemetry-collector
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.152.1-1.el9_8
0.152.1-1.el9_8
telegraf
Azure Linux:3
 before 1.31.0-22
1.31.0-22
prometheus
Bitnami
 before 0.305.3, 0.306.0 up to 0.311.3, 1.0.0 up to 3.5.3, 3.6.0 up to 3.11.3
0.305.30.311.33.5.33.11.3
prometheus
Debian:13
 All versions, plus listed versions
2.53.3+ds1-22.53.4+ds1-12.53.5+ds1-12.53.5+ds1-22.53.5+ds1-3
Show 8 moreShow less
2.53.5+ds1-42.53.5+ds1-53.5.3+ds1-13.5.3+ds1-23.5.3+ds1-33.5.3+ds1-43.5.3+ds1-53.5.3+ds1-6~exp1
 None known
prometheus
Debian:14
 before 3.5.3+ds1-1, plus listed versions
2.53.3+ds1-22.53.4+ds1-12.53.5+ds1-12.53.5+ds1-22.53.5+ds1-32.53.5+ds1-42.53.5+ds1-5
3.5.3+ds1-1
jaeger
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:2.19.0-1.hum1
0:2.19.0-1.hum1
Show 99 moreShow less
Affected packages
PackageAffectedFixed
opentelemetry-collector
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:0.153.0-1.hum1
0:0.153.0-1.hum1
opentelemetry-collector-contrib
Red Hat:hummingbird:1
 before 0:0.153.0-1.hum1
0:0.153.0-1.hum1
opentelemetry-collector
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:0.152.1-1.el10_2
0:0.152.1-1.el10_2
opentelemetry-collector
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:0.152.1-1.el9_8
0:0.152.1-1.el9_8
flightctl
Red Hat:edge_manager:1.0::el9
From an advisory covering 23 CVEs
 before 0:1.0.3-1.el9em
0:1.0.3-1.el9em
flightctl-agent
Red Hat:edge_manager:1.0::el9
From an advisory covering 23 CVEs
 before 0:1.0.3-1.el9em
0:1.0.3-1.el9em
flightctl-cli
Red Hat:edge_manager:1.0::el9
From an advisory covering 23 CVEs
 before 0:1.0.3-1.el9em
0:1.0.3-1.el9em
flightctl-selinux
Red Hat:edge_manager:1.0::el9
From an advisory covering 23 CVEs
 before 0:1.0.3-1.el9em
0:1.0.3-1.el9em
flightctl
Red Hat:edge_manager:1.1::el10
From an advisory covering 22 CVEs
 before 0:1.1.3-1.el10em
0:1.1.3-1.el10em
flightctl-agent
Red Hat:edge_manager:1.1::el10
From an advisory covering 22 CVEs
 before 0:1.1.3-1.el10em
0:1.1.3-1.el10em
flightctl-cli
Red Hat:edge_manager:1.1::el10
From an advisory covering 22 CVEs
 before 0:1.1.3-1.el10em
0:1.1.3-1.el10em
flightctl
Red Hat:edge_manager:1.1::el9
From an advisory covering 22 CVEs
 before 0:1.1.3-1.el9em
0:1.1.3-1.el9em
flightctl-agent
Red Hat:edge_manager:1.1::el9
From an advisory covering 22 CVEs
 before 0:1.1.3-1.el9em
0:1.1.3-1.el9em
flightctl-cli
Red Hat:edge_manager:1.1::el9
From an advisory covering 22 CVEs
 before 0:1.1.3-1.el9em
0:1.1.3-1.el9em
opentelemetry-collector
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:0.152.1-1.el9_4
0:0.152.1-1.el9_4
opentelemetry-collector
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:0.152.1-1.el10_0
0:0.152.1-1.el10_0
opentelemetry-collector
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:0.152.1-1.el9_6
0:0.152.1-1.el9_6
opentelemetry-collector
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:0.152.1-1.el10_2
0:0.152.1-1.el10_2
opentelemetry-collector
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:0.152.1-1.el9_8
0:0.152.1-1.el9_8
github.com/prometheus/prometheus
Root:Go
 before v0.302.0-aikido.2
v0.302.0-aikido.2v0.303.0-aikido.5v0.308.1-aikido.3
rootio-github.com/prometheus/prometheus
Root:Go
 before v0.303.0-root.io.1
v0.303.0-root.io.1v0.308.1-root.io.1v0.303.0-root.io.2v0.302.0-root.io.2v0.303.0-root.io.5v0.308.1-root.io.3
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-QubitProducts-exporter_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.4.0-150002.3.6.2
0.4.0-150002.3.6.2
golang-github-boynux-squid_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.13.0-150002.3.6.2
1.13.0-150002.3.6.2
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.0.10-150002.3.9.2
1.0.10-150002.3.9.2
golang-github-prometheus-alertmanager
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.28.1-150002.4.11.1
0.28.1-150002.4.11.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 3.5.3-150002.3.13.1
3.5.3-150002.3.13.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 11.6.14+security04-150002.4.21.1
11.6.14+security04-150002.4.21.1
mgr-push
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.4-150002.3.9.1
5.2.4-150002.3.9.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.26.0-150002.3.11.1
0.26.0-150002.3.11.1
prometheus-postgres_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.10.1-150002.3.3.2
0.10.1-150002.3.3.2
python-defusedxml-sle15
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.7.1-150002.1.3.1
0.7.1-150002.1.3.1
rhnlib
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.5-150002.3.9.1
5.2.5-150002.3.9.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.8-150002.3.12.1
5.2.8-150002.3.12.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.6-150002.3.9.1
5.2.6-150002.3.9.1
supportutils-plugin-salt
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.2.3-150002.3.3.1
1.2.3-150002.3.3.1
supportutils-plugin-susemanager-client
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.3-150002.3.9.1
5.2.3-150002.3.9.1
uyuni-common-libs
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.5-150002.3.6.1
5.2.5-150002.3.6.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-aarch64-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-s390x-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-s390x-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-s390x-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-x86_64-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
uyuni-tools
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.29-150700.3.26.1
5.1.29-150700.3.26.1
suse-multi-linux-manager-5.1-aarch64-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-aarch64-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-aarch64-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-aarch64-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
suse-multi-linux-manager-5.1-ppc64le-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-ppc64le-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-ppc64le-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
suse-multi-linux-manager-5.1-s390x-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-s390x-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-s390x-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-s390x-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
suse-multi-linux-manager-5.1-x86_64-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-x86_64-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-x86_64-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-x86_64-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
uyuni-tools
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.29-150700.3.26.1
5.1.29-150700.3.26.1
prometheus
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.14.0+ds-10.16.2+ds-10.16.2+ds-1ubuntu1
 None known
prometheus
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.7.1+ds-11.8.1+ds-22.1.0+ds-1
 None known
prometheus
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.7.1+ds-32.15.2+ds-2
 None known
prometheus
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.24.1+ds-1ubuntu12.24.1+ds-1ubuntu22.31.1+ds2-22.31.2+ds1-12.31.2+ds1-1ubuntu1
Show 6 moreShow less
2.31.2+ds1-1ubuntu1.22.04.12.31.2+ds1-1ubuntu1.22.04.22.31.2+ds1-1ubuntu1.22.04.32.31.2+ds1-1ubuntu1.22.04.3+esm12.31.2+ds1-1ubuntu1.22.04.3+esm22.31.2+ds1-1ubuntu1.22.04.3+esm3
 None known
prometheus
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.45.0+ds-3build12.45.1+ds-12.45.1+ds-22.45.1+ds-32.45.3+ds-2
Show 8 moreShow less
2.45.3+ds-2build12.45.3+ds-2ubuntu0.12.45.3+ds-2ubuntu0.22.45.3+ds-2ubuntu0.2+esm12.45.3+ds-2ubuntu0.2+esm22.45.3+ds-2ubuntu0.32.45.3+ds-2ubuntu0.3+esm12.45.3+ds-2ubuntu0.3+esm2
 None known
prometheus
Ubuntu:25.10
 All versions, plus listed versions
2.53.3+ds1-12.53.3+ds1-2
 None known
prometheus
Ubuntu:26.10
 All versions, plus listed versions
2.53.5+ds1-33.5.3+ds1-33.5.3+ds1-5
 None known
prometheus
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.53.3+ds1-22.53.5+ds1-22.53.5+ds1-32.53.5+ds1-3ubuntu0.26.04.1~esm1
 None known
golang-github-prometheus-prometheus
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.11.3-1.1
3.11.3-1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42151 is a high vulnerability (CVSS 7.5) in Prometheus, published May 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in github.com/prometheus/prometheus 0.311.3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,964 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open