123 matches found
CLEANSTART-2026-ZS27491 Security fix for CVE-2026-21726 applied in: grafana-alloy 1.15.1-r1, grafana-alloy 1.16.0-r0, grafana-alloy-fips 1.14.2-r1, grafana-alloy-fips 1.15.0-r2, grafana-alloy-fips 1.15.1-r0, grafana-alloy-fips 1.16.0-r0
CVE-2026-21726 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-NK57336 go-git is an extensible git implementation library written in pure Go
Multiple security vulnerabilities affect the grafana-alloy package. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, sqlexporter, vault, splunk-otel-collector-fips, sqlexporter-fips, opentelemetry-collector-contrib, grafana-alloy-fips, grafana-alloy, opentelemetry-collector-contrib-fips...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy-fips, grafana-alloy, grafana-fips, commercial-grafana...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: cluster-autoscaler, grype, ctop, neuvector-fips, cadvisor-fips, k8s-device-plugin, opentelemetry-collector-contrib-fips, gosu, eks-distro, kubernetes, cadvisor, docker, k3s, grafana-alloy-fips, opentelemetry-collector-contrib, kubernetes-fips, podman, grafana-alloy,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: bento-fips, splunk-otel-collector, splunk-otel-collector-fips, grafana-alloy-fips, bento, kots, steampipe, teleport, grafana-alloy, telegraf...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: argo-workflows-fips, opentelemetry-collector, kargo, opentelemetry-collector-contrib-fips, amazon-cloudwatch-agent-fips, amazon-cloudwatch-agent, splunk-otel-collector-fips, eks-distro, argo-rollouts-fips, argo-workflows, splunk-otel-collector, argo-cd-fips,...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: sqlexporter, splunk-otel-collector, grafana-alloy, opentelemetry-collector-contrib...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: nuclei, zot, tflint, gptscript, terragrunt, steampipe, gitness, rancher-fleet, terraform, trivy, zarf, podman, nsc, guac, undock, filebrowser, trivy-operator, k9s, opentofu, xeol, trufflehog, grafana-alloy, vcluster, gitleaks, kubescape-operator, envoy-gateway...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: malcontent, minio, redpanda, witness, goreleaser, ollama, maru, nfpm, nuclei, dgraph, terraform-mcp-server, cri-tools, teleport, grafana, opentelemetry-collector-contrib, weaviate, rclone, lazygit, kubevela, tempo, eksctl, gitlab-runner, k3s, opentelemetry-collector,...