122 matches found
CLEANSTART-2026-NK57336 go-git is an extensible git implementation library written in pure Go
Multiple security vulnerabilities affect the grafana-alloy package. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy, sqlexporter-fips, opentelemetry-collector-contrib, vault, splunk-otel-collector-fips, splunk-otel-collector, grafana-alloy-fips, sqlexporter, opentelemetry-collector-contrib-fips...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana-fips, grafana-alloy-fips, grafana, commercial-grafana...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, syft, kubernetes-fips, k8s-device-plugin, podman, cluster-autoscaler, kubernetes, gosu, ctop, buildah, eks-distro, grafana-alloy-fips, k3s, eks-distro-fips, opentelemetry-collector-contrib-fips, neuvector-scanner-fips, grype, cadvisor...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: steampipe, grafana-alloy, teleport, kots, splunk-otel-collector-fips, bento-fips, grafana-alloy-fips, bento, splunk-otel-collector, telegraf...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, argo-workflows, argo-rollouts-fips, keda, eks-distro, k8sgpt, grafana-alloy-fips, splunk-otel-collector, kargo, eks-distro-fips, argo-rollouts, opentelemetry-collector-contrib-fips, argo-cd, nats, kubeflow-pipelines,...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: sqlexporter, grafana-alloy, opentelemetry-collector-contrib, splunk-otel-collector...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: gitness, guac, grafana-alloy, envoy-gateway, kubescape-operator, k9s, nsc, opentofu, undock, steampipe, vcluster, zarf, zot, filebrowser, tflint, nuclei, trufflehog, rancher-fleet, trivy-operator, gitleaks, gptscript, podman, xeol, terragrunt, trivy, terraform...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: eksctl, kubevela, opentelemetry-collector-contrib, grafana-alloy, ollama, dagger, teleport, gitlab-runner, malcontent, dgraph, nfpm, mcp-grafana, minio, vcluster, loki, lazygit, witness, goreleaser, tempo, grafana, k3s, terraform-mcp-server, k8sgpt, prometheus, nucle...