Open source Prometheus servers and exporters are leaking plaintext passwords and tokens, along with API addresses of internal locations.