121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib-fips, grafana-alloy, opentelemetry-collector-contrib, splunk-otel-collector, splunk-otel-collector-fips, sqlexporter, vault, sqlexporter-fips, grafana-alloy-fips...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, commercial-grafana, grafana-fips, grafana, grafana-alloy-fips...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: neuvector, cluster-autoscaler-fips, kubernetes-fips, cluster-autoscaler, grype, k3s, podman, eks-distro, cadvisor, opentelemetry-collector-contrib-fips, grafana-alloy, neuvector-fips, cadvisor-fips, docker, k8s-device-plugin, neuvector-scanner-fips, syft, buildah,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: grafana-alloy, bento-fips, kots, splunk-otel-collector, splunk-otel-collector-fips, bento, steampipe, telegraf, teleport, grafana-alloy-fips...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, keda, argo-cd-fips, argo-cd, argo-rollouts-fips, opentelemetry-collector, k8sgpt, argo-workflows, argo-rollouts, amazon-cloudwatch-agent-fips, eks-distro, opentelemetry-collector-contrib-fips, grafana-alloy, kubeflow-pipelines,...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, sqlexporter, splunk-otel-collector, grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: trivy-operator, envoy-gateway, terragrunt, guac, gitleaks, k9s, xeol, kubescape-operator, trufflehog, tflint, undock, podman, nuclei, grafana-alloy, trivy, zarf, nsc, gptscript, vcluster, gitness, opentofu, steampipe, terraform, filebrowser, rancher-fleet, zot...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: nfpm, opentelemetry-collector-contrib, lazygit, weaviate, terragrunt, eksctl, witness, redpanda, maru, k3s, rclone, datadog-agent, mcp-grafana, dgraph, nuclei, grafana-alloy, k8sgpt, malcontent, dagger, ollama, grafana, gitlab-runner, prometheus,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: sriov-network-device-plugin, nvidia-container-toolkit, falco-no-driver, kubernetes, podman, buildah, node-feature-discovery, k3s, grafana-alloy...