The vulnerability arises from the Azure AD remote‑write OAuth configuration field `client_secret` being stored as a plain string. Because Prometheus only redacts values of type Secret in the /-/config API, the secret is returned in cleartext to anyone who can access the endpoint. This exposure permits an attacker to obtain the OAuth client credential, which could be used to authenticate to Prometheus services and gain unauthorized access to sensitive monitoring data or modify metric streams.

Prometheus versions prior to 3.5.3 and 3.11.3 are affected. The issue was fixed in releases 3.5.3 and 3.11.3, and any later version should be considered secure.

The CVSS score of 7.5 indicates a significant impact. The EPSS score of 0.0001 (less than 1%) shows a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog, suggesting it has not yet been widely exploited. Attackers can exploit the flaw by accessing the internal /-/config endpoint; if the endpoint is exposed to the network or accessible to local processes, the secret can be read and subsequently used to impersonate Prometheus and compromise the confidentiality of monitoring data.