CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: grafana-alloy, sqlexporter, vault, sqlexporter-fips, grafana-alloy-fips, splunk-otel-collector-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib, splunk-otel-collector...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana, grafana-alloy, commercial-grafana, grafana-fips, grafana-alloy-fips...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: neuvector-fips, node-feature-discovery, runc, eks-distro, opentelemetry-collector-contrib, cluster-autoscaler, eks-distro-fips, opentelemetry-collector-contrib-fips, cadvisor, grafana-alloy, cluster-autoscaler-fips, grype, syft, kubernetes, neuvector-scanner, ctop,...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: bento, grafana-alloy, kots, grafana-alloy-fips, splunk-otel-collector-fips, teleport, steampipe, telegraf, bento-fips, splunk-otel-collector...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kargo, k8sgpt, eks-distro, opentelemetry-collector-contrib, eks-distro-fips, nats, grafana-alloy, opentelemetry-collector-contrib-fips, splunk-otel-collector, tempo, amazon-cloudwatch-agent-fips, argo-rollouts-fips, argo-cd,...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana, grafana-alloy...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: sqlexporter, opentelemetry-collector-contrib, grafana-alloy, splunk-otel-collector...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: kubescape-operator, opentofu, gptscript, vcluster, guac, zarf, k9s, trufflehog, filebrowser, nuclei, podman, trivy, gitness, zot, trivy-operator, terragrunt, grafana-alloy, tflint, steampipe, nsc, terraform, envoy-gateway, undock, xeol, gitleaks, rancher-fleet...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: kubevela, eksctl, mcp-grafana, redpanda, rclone, vcluster, k8sgpt, dgraph, minio, opentelemetry-collector, k3s, prometheus, nuclei, nfpm, dagger, opentelemetry-collector-contrib, grafana, malcontent, terragrunt, grafana-alloy, ollama, loki, lazygit, tempo, goreleaser...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, kubernetes, grafana-alloy, nvidia-container-toolkit, k3s, buildah, falco-no-driver, sriov-network-device-plugin, podman...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, kubernetes, grafana-alloy, nvidia-container-toolkit, k3s, buildah, falco-no-driver, sriov-network-device-plugin, podman...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: docker, opentelemetry-collector-contrib, neuvector-scanner, kubernetes, grafana-alloy, ctop, k3s, buildah, cadvisor, podman, syft, grype, k8s-device-plugin, runc...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: steampipe, telegraf, grafana-alloy, splunk-otel-collector, bento, kots...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: src-fingerprint, kubevela, melange, gptscript, flux-kustomize-controller, pulumi-language-dotnet, flux, flux-source-controller, k8sgpt, kaniko, guac, skaffold, timoni, chezmoi, kubescape, zarf, kargo, k9s, osv-scanner, wolfictl, pulumi, nuclei, syft, grype, gitsign,...