121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy, opentelemetry-collector-contrib, splunk-otel-collector, opentelemetry-collector-contrib-fips, grafana-alloy-fips, sqlexporter-fips, sqlexporter, vault, splunk-otel-collector-fips...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-fips, grafana-alloy, grafana, commercial-grafana, grafana-alloy-fips...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: grafana-alloy, cadvisor-fips, docker, eks-distro-fips, neuvector-scanner, runc, grype, neuvector-scanner-fips, cluster-autoscaler, kubernetes-fips, opentelemetry-collector-contrib-fips, syft, podman, k8s-device-plugin, neuvector, opentelemetry-collector-contrib,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: grafana-alloy, steampipe, splunk-otel-collector, teleport, telegraf, grafana-alloy-fips, bento, splunk-otel-collector-fips, kots, bento-fips...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: grafana-alloy, eks-distro-fips, opentelemetry-collector, splunk-otel-collector, argo-rollouts, kargo, keda, opentelemetry-collector-fips, amazon-cloudwatch-agent, amazon-cloudwatch-agent-fips, opentelemetry-collector-contrib-fips, splunk-otel-collector-fips,...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy, opentelemetry-collector-contrib, sqlexporter, splunk-otel-collector...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: steampipe, k9s, terragrunt, opentofu, podman, trivy, envoy-gateway, undock, kubescape-operator, zot, rancher-fleet, trivy-operator, gitness, filebrowser, gptscript, nsc, guac, tflint, xeol, terraform, grafana-alloy, nuclei, zarf, vcluster, trufflehog, gitleaks...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: redpanda, k3s, terragrunt, datadog-agent, tempo, dagger, cri-tools, terraform-mcp-server, dgraph, teleport, k8sgpt, weaviate, maru, lazygit, prometheus, mcp-grafana, nfpm, ollama, minio, rclone, opentelemetry-collector, goreleaser, grafana-alloy, gitlab-runner, nucle...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: falco-no-driver, nvidia-container-toolkit, grafana-alloy, k3s, kubernetes, sriov-network-device-plugin, podman, buildah, node-feature-discovery...