CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: sqlexporter-fips, opentelemetry-collector-contrib-fips, sqlexporter, grafana-alloy-fips, splunk-otel-collector, opentelemetry-collector-contrib, vault, splunk-otel-collector-fips, grafana-alloy...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana, grafana-alloy-fips, grafana-fips, commercial-grafana, grafana-alloy...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: kubernetes, cluster-autoscaler-fips, grafana-alloy-fips, eks-distro, k8s-device-plugin, neuvector-scanner, grype, cluster-autoscaler, ctop, k3s, syft, gosu, opentelemetry-collector-contrib, kubernetes-fips, cadvisor-fips, podman, buildah, neuvector-fips,...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: bento, grafana-alloy-fips, splunk-otel-collector, steampipe, teleport, kots, telegraf, bento-fips, splunk-otel-collector-fips, grafana-alloy...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, kubeflow-pipelines, argo-rollouts, argo-workflows, grafana-alloy-fips, tempo, argo-workflows-fips, eks-distro, argo-cd, kargo, nats, amazon-cloudwatch-agent-fips, keda, opentelemetry-collector-fips, opentelemetry-collector-contrib,...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, grafana-alloy, splunk-otel-collector, sqlexporter...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: kubescape-operator, k9s, zarf, tflint, trivy, opentofu, nsc, gitleaks, guac, nuclei, zot, gptscript, terragrunt, terraform, grafana-alloy, undock, trufflehog, filebrowser, envoy-gateway, podman, xeol, rancher-fleet, trivy-operator, gitness, vcluster, steampipe...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: tempo, weaviate, cri-tools, vcluster, prometheus, opentelemetry-collector-contrib, ollama, terraform-mcp-server, teleport, nfpm, nuclei, goreleaser, gitlab-runner, minio, eksctl, datadog-agent, grafana, terragrunt, grafana-alloy, rclone, dgraph, loki, witness,...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: grafana-alloy, node-feature-discovery, buildah, k3s, nvidia-container-toolkit, podman, falco-no-driver, kubernetes, sriov-network-device-plugin...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: grafana-alloy, node-feature-discovery, buildah, k3s, nvidia-container-toolkit, podman, falco-no-driver, kubernetes, sriov-network-device-plugin...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, grafana-alloy, ctop, grype, buildah, k3s, k8s-device-plugin, podman, runc, syft, neuvector-scanner, cadvisor, docker, kubernetes...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: kots, grafana-alloy, bento, splunk-otel-collector, telegraf, steampipe...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, k9s, argo-workflows, zarf, pulumi-language-yaml, kubescape, osv-scanner, pulumi-kubernetes-operator, trivy, pulumi-language-dotnet, timoni, kargo, pulumi-language-java, src-fingerprint, flux-kustomize-controller, grype, guac, nuclei,...