121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector-fips, sqlexporter, splunk-otel-collector, grafana-alloy-fips, opentelemetry-collector-contrib-fips, vault, sqlexporter-fips, grafana-alloy, opentelemetry-collector-contrib...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy-fips, grafana-fips, grafana-alloy, commercial-grafana...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: neuvector-fips, buildah, k8s-device-plugin, neuvector-scanner-fips, runc, grafana-alloy-fips, opentelemetry-collector-contrib-fips, podman, grype, eks-distro-fips, kubernetes-fips, k3s, kubernetes, cadvisor, neuvector-scanner, neuvector, cadvisor-fips,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector-fips, splunk-otel-collector, kots, grafana-alloy-fips, bento-fips, steampipe, telegraf, teleport, grafana-alloy, bento...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector-fips, argo-workflows-fips, grafana-alloy-fips, opentelemetry-collector-contrib-fips, kargo, amazon-cloudwatch-agent, eks-distro-fips, argo-rollouts, keda, argo-cd-fips, opentelemetry-collector, nats, k8sgpt, argo-rollouts-fips, grafana-alloy,...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy, sqlexporter, splunk-otel-collector, opentelemetry-collector-contrib...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: kubescape-operator, undock, podman, nuclei, filebrowser, xeol, rancher-fleet, steampipe, trufflehog, trivy-operator, tflint, zot, opentofu, vcluster, nsc, terragrunt, gitleaks, gitness, guac, k9s, grafana-alloy, zarf, trivy, envoy-gateway, terraform, gptscript...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: lazygit, nfpm, teleport, rclone, weaviate, goreleaser, malcontent, grafana, witness, datadog-agent, nuclei, tempo, gitlab-runner, kubevela, opentelemetry-collector, cri-tools, eksctl, prometheus, loki, vcluster, terragrunt, dagger, mcp-grafana,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: node-feature-discovery, buildah, nvidia-container-toolkit, falco-no-driver, sriov-network-device-plugin, podman, kubernetes, grafana-alloy, k3s...