CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector-fips, sqlexporter-fips, vault, splunk-otel-collector, opentelemetry-collector-contrib, grafana-alloy-fips, sqlexporter, grafana-alloy, opentelemetry-collector-contrib-fips...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana, grafana-fips, commercial-grafana, grafana-alloy-fips, grafana-alloy...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: syft, neuvector-fips, eks-distro, eks-distro-fips, cluster-autoscaler, opentelemetry-collector-contrib-fips, grype, buildah, k8s-device-plugin, ctop, cadvisor, podman, kubernetes-fips, opentelemetry-collector-contrib, runc, neuvector-scanner, gosu,...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector-fips, bento-fips, splunk-otel-collector, kots, steampipe, bento, teleport, grafana-alloy-fips, telegraf, grafana-alloy...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: eks-distro, eks-distro-fips, nats, argo-workflows-fips, opentelemetry-collector-contrib-fips, argo-cd-fips, argo-workflows, splunk-otel-collector-fips, amazon-cloudwatch-agent, kargo, splunk-otel-collector, keda, kubeflow-pipelines, opentelemetry-collector-contrib,...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: grafana-alloy, sqlexporter, splunk-otel-collector, opentelemetry-collector-contrib...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: nsc, gptscript, zot, zarf, steampipe, k9s, opentofu, kubescape-operator, grafana-alloy, undock, terragrunt, xeol, podman, filebrowser, vcluster, trufflehog, tflint, trivy, gitness, rancher-fleet, gitleaks, terraform, trivy-operator, envoy-gateway, nuclei, guac...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: malcontent, terraform-mcp-server, witness, loki, grafana, goreleaser, dagger, kubevela, prometheus, minio, k8sgpt, opentelemetry-collector, redpanda, mcp-grafana, maru, grafana-alloy, teleport, dgraph, terragrunt, lazygit, datadog-agent, nfpm, vcluster, cri-tools,...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: sriov-network-device-plugin, podman, buildah, nvidia-container-toolkit, k3s, kubernetes, falco-no-driver, grafana-alloy, node-feature-discovery...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: sriov-network-device-plugin, podman, buildah, nvidia-container-toolkit, k3s, kubernetes, falco-no-driver, grafana-alloy, node-feature-discovery...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, podman, buildah, syft, k3s, kubernetes, ctop, grafana-alloy, k8s-device-plugin, grype, runc, docker, neuvector-scanner, cadvisor...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: telegraf, kots, grafana-alloy, bento, splunk-otel-collector, steampipe...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: timoni, apko, flux-kustomize-controller, tfsec, gptscript, zot, goreleaser, argo-events, snyk-cli, zarf, dagger, go-licenses, kubevela, k9s, flux-source-controller, k8sgpt, argocd-image-updater, pulumi-language-yaml, syft, crossplane, kots, grafana-alloy, scorecard,...