121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, splunk-otel-collector, sqlexporter, grafana-alloy, grafana-alloy-fips, sqlexporter-fips, splunk-otel-collector-fips, vault...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: commercial-grafana, grafana-fips, grafana-alloy, grafana-alloy-fips, grafana...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: neuvector-scanner-fips, opentelemetry-collector-contrib-fips, kubernetes, cadvisor, kubernetes-fips, eks-distro, opentelemetry-collector-contrib, neuvector, ctop, grafana-alloy, runc, grype, k8s-device-plugin, cluster-autoscaler, cluster-autoscaler-fips, gosu,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: teleport, bento-fips, splunk-otel-collector, steampipe, grafana-alloy, grafana-alloy-fips, kots, splunk-otel-collector-fips, telegraf, bento...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib-fips, k8sgpt, argo-rollouts-fips, argo-cd-fips, opentelemetry-collector-fips, argo-rollouts, eks-distro, kubeflow-pipelines, opentelemetry-collector-contrib, nats, argo-workflows, grafana-alloy, splunk-otel-collector-fips,...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, splunk-otel-collector, sqlexporter, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: k9s, grafana-alloy, gitleaks, zot, terraform, vcluster, filebrowser, rancher-fleet, zarf, opentofu, nuclei, trufflehog, envoy-gateway, steampipe, xeol, nsc, tflint, podman, undock, guac, gptscript, terragrunt, gitness, trivy, trivy-operator, kubescape-operator...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: datadog-agent, k3s, witness, goreleaser, grafana-alloy, loki, prometheus, rclone, vcluster, kubevela, gitlab-runner, cri-tools, maru, minio, nuclei, redpanda, opentelemetry-collector-contrib, ollama, teleport, k8sgpt, weaviate, eksctl, opentelemetry-collector,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: kubernetes, k3s, sriov-network-device-plugin, nvidia-container-toolkit, buildah, grafana-alloy, falco-no-driver, node-feature-discovery, podman...