121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector-fips, opentelemetry-collector-contrib-fips, splunk-otel-collector, opentelemetry-collector-contrib, sqlexporter-fips, sqlexporter, vault, grafana-alloy-fips, grafana-alloy...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, commercial-grafana, grafana-fips, grafana-alloy-fips, grafana-alloy...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: k3s, opentelemetry-collector-contrib, buildah, k8s-device-plugin, podman, runc, neuvector-scanner, cadvisor, neuvector-fips, gosu, neuvector, grafana-alloy-fips, cadvisor-fips, kubernetes, grafana-alloy, cluster-autoscaler, opentelemetry-collector-contrib-fips,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: kots, splunk-otel-collector-fips, steampipe, splunk-otel-collector, bento, telegraf, teleport, bento-fips, grafana-alloy-fips, grafana-alloy...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector-fips, opentelemetry-collector-contrib, argo-workflows-fips, k8sgpt, kubeflow-pipelines, opentelemetry-collector, amazon-cloudwatch-agent-fips, keda, argo-cd-fips, kargo, nats, argo-rollouts-fips, grafana-alloy-fips, argo-workflows, grafana-alloy...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy, splunk-otel-collector, sqlexporter, opentelemetry-collector-contrib...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: terragrunt, nuclei, rancher-fleet, trivy-operator, undock, grafana-alloy, kubescape-operator, trufflehog, nsc, podman, k9s, steampipe, filebrowser, terraform, vcluster, trivy, gptscript, gitness, gitleaks, xeol, opentofu, guac, zot, envoy-gateway, zarf, tflint...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: terragrunt, opentelemetry-collector-contrib, redpanda, nuclei, lazygit, nfpm, grafana-alloy, malcontent, kubevela, minio, dgraph, tempo, opentelemetry-collector, dagger, cri-tools, vcluster, terraform-mcp-server, teleport, prometheus, mcp-grafana, k8sgpt, k3s, ollama...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: sriov-network-device-plugin, node-feature-discovery, podman, kubernetes, k3s, buildah, nvidia-container-toolkit, falco-no-driver, grafana-alloy...