CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: grafana-alloy, opentelemetry-collector-contrib-fips, splunk-otel-collector, grafana-alloy-fips, splunk-otel-collector-fips, sqlexporter-fips, sqlexporter, opentelemetry-collector-contrib, vault...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy, commercial-grafana, grafana, grafana-alloy-fips, grafana-fips...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, neuvector, k8s-device-plugin, ctop, gosu, neuvector-scanner, docker, grafana-alloy, grafana-alloy-fips, podman, syft, node-feature-discovery, buildah, eks-distro, neuvector-scanner-fips, eks-distro-fips, cadvisor-fips, kubernetes,...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: grafana-alloy, steampipe, grafana-alloy-fips, splunk-otel-collector, bento-fips, kots, bento, splunk-otel-collector-fips, telegraf, teleport...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: argo-workflows, splunk-otel-collector, grafana-alloy, nats, argo-rollouts, grafana-alloy-fips, eks-distro, opentelemetry-collector-fips, eks-distro-fips, k8sgpt, kubeflow-pipelines, argo-cd-fips, argo-rollouts-fips, opentelemetry-collector,...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: sqlexporter, splunk-otel-collector, opentelemetry-collector-contrib, grafana-alloy...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: gptscript, gitness, trivy, vcluster, terraform, grafana-alloy, guac, steampipe, trufflehog, zarf, zot, rancher-fleet, podman, tflint, terragrunt, gitleaks, undock, xeol, nsc, kubescape-operator, filebrowser, trivy-operator, nuclei, k9s, opentofu, envoy-gateway...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: maru, k3s, tempo, nfpm, witness, grafana, vcluster, mcp-grafana, kubevela, grafana-alloy, gitlab-runner, datadog-agent, teleport, opentelemetry-collector, prometheus, redpanda, loki, minio, terragrunt, weaviate, ollama, dgraph, rclone, lazygit, nuclei, cri-tools,...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: podman, nvidia-container-toolkit, falco-no-driver, k3s, kubernetes, node-feature-discovery, sriov-network-device-plugin, buildah, grafana-alloy...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: podman, nvidia-container-toolkit, falco-no-driver, k3s, kubernetes, node-feature-discovery, sriov-network-device-plugin, buildah, grafana-alloy...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: runc, cadvisor, grype, podman, syft, opentelemetry-collector-contrib, neuvector-scanner, k3s, kubernetes, buildah, k8s-device-plugin, docker, ctop, grafana-alloy...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: telegraf, bento, grafana-alloy, steampipe, kots, splunk-otel-collector...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: snyk-cli, apko, kaniko, gitea, bom, flux-kustomize-controller, gptscript, trivy, flux-image-automation-controller, scorecard, grafana-alloy, kubevela, wolfictl, grype, argo-events, flux, guac, flux-source-controller, zarf, chezmoi, zot, go-licenses, tfsec, task,...