The vulnerability arises from the Azure AD remote‑write OAuth configuration field `client_secret` being stored as a plain string. Because Prometheus only redacts values of type Secret in the /-/config API, the secret is returned in cleartext to anyone who can access the endpoint. This exposure permits an attacker to obtain the OAuth client credential, which could be used to authenticate to Prometheus services and gain unauthorized access to sensitive monitoring data or modify metric streams.

Prometheus versions prior to 3.5.3 and 3.11.3 are affected. The issue was fixed in releases 3.5.3 and 3.11.3, and any later version should be considered secure.

The CVSS score of 7.5 indicates a significant impact. Although an EPSS score is not provided, the absence of the vulnerability from CISA's KEV catalog suggests it has not yet been widely exploited. Attackers can exploit the flaw by accessing the internal /-/config endpoint; if the endpoint is exposed to the network or accessible to local processes, the secret can be read and subsequently used to impersonate Prometheus and compromise the confidentiality of monitoring data.