Skip to content

fix: patch CVE-2026-42151 in github.com/prometheus/prometheus#2548

Merged
coleenquadros merged 1 commit into
release-2.17from
fix/cve-CVE-2026-42151-prometheus-release-2.17
Jul 9, 2026
Merged

fix: patch CVE-2026-42151 in github.com/prometheus/prometheus#2548
coleenquadros merged 1 commit into
release-2.17from
fix/cve-CVE-2026-42151-prometheus-release-2.17

Conversation

@coleenquadros

@coleenquadros coleenquadros commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Affected go.mod files

Only the root go.mod depends on github.com/prometheus/prometheus. The .bingo/go.mod does not.

Verification

  • govulncheck (before): GO-2026-5710 confirmed at v0.305.0
  • Source inspection: v0.305.0 has ClientSecret string (vulnerable); v0.305.3 has ClientSecret config_util.Secret (fixed)
  • govulncheck (after): Database lists v0.311.3 as fix (does not track v0.305.3 backport), but source-level verification confirms the fix is present
  • Build: go build ./... passes
  • Tests: All unit tests pass; E2E tests skipped (require live cluster)

Jira

  • ACM-36210
  • ACM-36241
  • ACM-36249
  • ACM-36250

Test plan

  • go build ./... compiles successfully
  • go test ./... unit tests pass
  • go mod verify checksums valid
  • Source-level verification that ClientSecret field type changed from string to config_util.Secret
  • CI passes on this PR

🤖 Generated with Claude Code

@coderabbitai

coderabbitai Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)
  • main
  • release-2.1[4-6]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5a2efe3e-60e1-4d01-805b-79eea54ac988

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/cve-CVE-2026-42151-prometheus-release-2.17

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the approved label Jul 7, 2026
@coleenquadros

coleenquadros commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

/test test-e2e

jacobbaungard
jacobbaungard approved these changes Jul 8, 2026
View reviewed changes

@jacobbaungard jacobbaungard left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci Bot added the lgtm label Jul 8, 2026
@openshift-ci

openshift-ci Bot commented Jul 8, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: coleenquadros, jacobbaungard

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [coleenquadros,jacobbaungard]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coleenquadros

coleenquadros commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

/test test-e2e

1 similar comment
@coleenquadros

coleenquadros commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

/test test-e2e

@coleenquadros @claude
fix: patch CVE-2026-42151 in github.com/prometheus/prometheus
6ae9a5c 
Bump github.com/prometheus/prometheus from v0.305.0 to v0.305.3 to fix
CVE-2026-42151 (GHSA-wg65-39gg-5wfj): Prometheus Azure AD remote write
OAuth client_secret was exposed via config API because the ClientSecret
field in storage/remote/azuread OAuthConfig was typed as string instead
of config_util.Secret, bypassing redaction.

Upstream fix: prometheus/prometheus#18587, #18590
Jira: ACM-36210, ACM-36241, ACM-36249, ACM-36250

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Signed-off-by: Coleen Iona Quadros <[email protected]>
@coleenquadros
coleenquadros force-pushed the fix/cve-CVE-2026-42151-prometheus-release-2.17 branch from 81fea42 to 6ae9a5c Compare July 9, 2026 10:16
@openshift-ci openshift-ci Bot removed the lgtm label Jul 9, 2026
@openshift-ci

openshift-ci Bot commented Jul 9, 2026

Copy link
Copy Markdown

New changes are detected. LGTM label has been removed.

@jacobbaungard

jacobbaungard commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

/test test-e2e

@coleenquadros
coleenquadros merged commit 3e98caf into release-2.17 Jul 9, 2026
24 of 26 checks passed
@coleenquadros
coleenquadros deleted the fix/cve-CVE-2026-42151-prometheus-release-2.17 branch July 9, 2026 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jacobbaungard jacobbaungard jacobbaungard approved these changes

Assignees

@jacobbaungard jacobbaungard

Labels

approved dco-signoff: yes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@coleenquadros @jacobbaungard