121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, sqlexporter, opentelemetry-collector-contrib, splunk-otel-collector-fips, opentelemetry-collector-contrib-fips, vault, sqlexporter-fips, splunk-otel-collector, grafana-alloy...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, commercial-grafana, grafana, grafana-fips, grafana-alloy...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: podman, opentelemetry-collector-contrib, neuvector-scanner-fips, cadvisor-fips, eks-distro, syft, grafana-alloy-fips, kubernetes, docker, gosu, neuvector-fips, runc, grype, grafana-alloy, cluster-autoscaler-fips, cluster-autoscaler, cadvisor, kubernetes-fips,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: steampipe, grafana-alloy-fips, bento, splunk-otel-collector-fips, telegraf, bento-fips, splunk-otel-collector, teleport, kots, grafana-alloy...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: kargo, opentelemetry-collector-contrib, k8sgpt, argo-rollouts, splunk-otel-collector, eks-distro, amazon-cloudwatch-agent-fips, grafana-alloy-fips, splunk-otel-collector-fips, argo-workflows, kubeflow-pipelines, keda, opentelemetry-collector-fips, argo-cd-fips,...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, grafana-alloy, splunk-otel-collector, sqlexporter...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: vcluster, zarf, guac, kubescape-operator, opentofu, undock, gitleaks, tflint, filebrowser, podman, gptscript, zot, trufflehog, xeol, steampipe, terraform, grafana-alloy, envoy-gateway, rancher-fleet, trivy-operator, k9s, terragrunt, nuclei, gitness, trivy, nsc...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: lazygit, kubevela, maru, vcluster, teleport, loki, cri-tools, dagger, ollama, prometheus, witness, eksctl, weaviate, malcontent, opentelemetry-collector-contrib, gitlab-runner, grafana-alloy, redpanda, dgraph, grafana, datadog-agent, terraform-mcp-server, goreleaser,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: grafana-alloy, falco-no-driver, nvidia-container-toolkit, k3s, sriov-network-device-plugin, buildah, node-feature-discovery, kubernetes, podman...