121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, splunk-otel-collector-fips, splunk-otel-collector, sqlexporter, grafana-alloy, vault, sqlexporter-fips...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, commercial-grafana, grafana-alloy, grafana, grafana-fips...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: kubernetes-fips, opentelemetry-collector-contrib-fips, neuvector-scanner, podman, cadvisor, grafana-alloy, kubernetes, cluster-autoscaler-fips, grafana-alloy-fips, eks-distro, docker, k8s-device-plugin, cluster-autoscaler, eks-distro-fips,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, steampipe, bento, splunk-otel-collector-fips, splunk-otel-collector, kots, grafana-alloy, bento-fips, telegraf, teleport...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: argo-workflows-fips, opentelemetry-collector-contrib-fips, splunk-otel-collector-fips, grafana-alloy, argo-rollouts, amazon-cloudwatch-agent-fips, grafana-alloy-fips, kargo, eks-distro, kubeflow-pipelines, argo-cd-fips, k8sgpt, argo-workflows, eks-distro-fips,...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: sqlexporter, opentelemetry-collector-contrib, grafana-alloy, splunk-otel-collector...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: trufflehog, vcluster, zot, gitness, nsc, kubescape-operator, opentofu, tflint, zarf, gptscript, grafana-alloy, trivy-operator, envoy-gateway, guac, terragrunt, filebrowser, undock, podman, steampipe, xeol, trivy, k9s, gitleaks, rancher-fleet, nuclei, terraform...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector, datadog-agent, eksctl, ollama, loki, dagger, cri-tools, vcluster, opentelemetry-collector-contrib, weaviate, gitlab-runner, goreleaser, lazygit, minio, nfpm, kubevela, k8sgpt, grafana-alloy, redpanda, mcp-grafana, terragrunt, grafana,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: podman, buildah, kubernetes, k3s, node-feature-discovery, nvidia-container-toolkit, sriov-network-device-plugin, grafana-alloy, falco-no-driver...