CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector-fips, sqlexporter, splunk-otel-collector, grafana-alloy, sqlexporter-fips, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, vault, grafana-alloy-fips...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana, commercial-grafana, grafana-alloy, grafana-fips, grafana-alloy-fips...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler, neuvector-fips, ctop, neuvector-scanner-fips, kubernetes, node-feature-discovery, buildah, cadvisor, cluster-autoscaler-fips, k8s-device-plugin, neuvector-scanner, grafana-alloy-fips, docker, eks-distro-fips, gosu, neuvector, grafana-alloy, syft,...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector-fips, teleport, bento, bento-fips, kots, splunk-otel-collector, steampipe, telegraf, grafana-alloy, grafana-alloy-fips...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: kargo, argo-rollouts-fips, splunk-otel-collector, kubeflow-pipelines, splunk-otel-collector-fips, argo-workflows, argo-workflows-fips, amazon-cloudwatch-agent-fips, k8sgpt, keda, argo-cd-fips, argo-cd, grafana-alloy-fips, opentelemetry-collector-fips,...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: grafana-alloy, sqlexporter, splunk-otel-collector, opentelemetry-collector-contrib...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: podman, k9s, gitleaks, grafana-alloy, gitness, terragrunt, rancher-fleet, vcluster, steampipe, guac, opentofu, gptscript, trufflehog, undock, trivy, nuclei, kubescape-operator, terraform, tflint, nsc, trivy-operator, zot, xeol, zarf, filebrowser, envoy-gateway...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: prometheus, grafana-alloy, goreleaser, k8sgpt, terragrunt, cri-tools, minio, k3s, vcluster, malcontent, dagger, teleport, witness, maru, mcp-grafana, dgraph, eksctl, weaviate, ollama, rclone, tempo, gitlab-runner, nuclei, redpanda, datadog-agent,...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: podman, grafana-alloy, falco-no-driver, buildah, node-feature-discovery, sriov-network-device-plugin, nvidia-container-toolkit, kubernetes, k3s...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: podman, grafana-alloy, falco-no-driver, buildah, node-feature-discovery, sriov-network-device-plugin, nvidia-container-toolkit, kubernetes, k3s...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: podman, ctop, runc, grafana-alloy, neuvector-scanner, k8s-device-plugin, buildah, docker, grype, opentelemetry-collector-contrib, kubernetes, k3s, syft, cadvisor...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: steampipe, bento, grafana-alloy, telegraf, splunk-otel-collector, kots...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: skaffold, k9s, task, grafana-alloy, apko, flux-image-automation-controller, goreleaser, k8sgpt, syft, pulumi-language-dotnet, osv-scanner, tfsec, guac, kargo, scorecard, dagger, flux-kustomize-controller, gptscript, argo-events, argocd-image-updater, gitsign, wolfict...