CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: grafana-alloy, splunk-otel-collector-fips, grafana-alloy-fips, splunk-otel-collector, opentelemetry-collector-contrib-fips, sqlexporter, vault, sqlexporter-fips, opentelemetry-collector-contrib...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: commercial-grafana, grafana-alloy, grafana-alloy-fips, grafana-fips, grafana...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: podman, cluster-autoscaler-fips, grafana-alloy, buildah, cadvisor-fips, node-feature-discovery, syft, k3s, docker, kubernetes-fips, runc, neuvector-scanner, kubernetes, neuvector-fips, gosu, eks-distro-fips, ctop, grafana-alloy-fips, eks-distro, neuvector-scanner-fip...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: steampipe, bento, grafana-alloy, splunk-otel-collector-fips, grafana-alloy-fips, splunk-otel-collector, telegraf, bento-fips, kots, teleport...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, opentelemetry-collector-fips, grafana-alloy, kubeflow-pipelines, k8sgpt, argo-cd, argo-workflows-fips, nats, kargo, argo-rollouts-fips, splunk-otel-collector-fips, eks-distro-fips, tempo, argo-workflows, grafana-alloy-fips, keda, eks-distro,...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, sqlexporter, opentelemetry-collector-contrib, grafana-alloy...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana, grafana-alloy...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: xeol, trivy, nuclei, terragrunt, trivy-operator, grafana-alloy, trufflehog, terraform, gitleaks, vcluster, filebrowser, gptscript, zot, kubescape-operator, gitness, rancher-fleet, steampipe, podman, nsc, undock, opentofu, tflint, guac, k9s, zarf, envoy-gateway...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: goreleaser, nuclei, terragrunt, opentelemetry-collector, grafana-alloy, eksctl, gitlab-runner, maru, malcontent, minio, weaviate, k8sgpt, lazygit, grafana, tempo, redpanda, loki, datadog-agent, terraform-mcp-server, kubevela, vcluster, k3s, nfpm, cri-tools, dgraph,...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: falco-no-driver, podman, grafana-alloy, nvidia-container-toolkit, kubernetes, sriov-network-device-plugin, buildah, node-feature-discovery, k3s...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: falco-no-driver, podman, grafana-alloy, nvidia-container-toolkit, kubernetes, sriov-network-device-plugin, buildah, node-feature-discovery, k3s...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, k8s-device-plugin, ctop, podman, runc, grafana-alloy, grype, kubernetes, docker, opentelemetry-collector-contrib, buildah, cadvisor, syft, k3s...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: kots, splunk-otel-collector, telegraf, grafana-alloy, steampipe, bento...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: goreleaser, chezmoi, trivy, nuclei, skaffold, melange, gitsign, osv-scanner, tfsec, grafana-alloy, flux, flux-image-automation-controller, gitea, wolfictl, pulumi, syft, snyk-cli, timoni, k8sgpt, pulumi-language-java, kubescape, crossplane, pulumi-language-dotnet,...