114 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, sqlexporter, opentelemetry-collector-contrib-fips, sqlexporter-fips, grafana-alloy, splunk-otel-collector-fips, vault, opentelemetry-collector-contrib, splunk-otel-collector...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-fips, grafana-alloy-fips, grafana-alloy, grafana, commercial-grafana...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: ctop, kubernetes-fips, grafana-alloy, k8s-device-plugin, neuvector-fips, gosu, runc, cluster-autoscaler, eks-distro, docker, syft, node-feature-discovery, grafana-alloy-fips, cadvisor, neuvector-scanner-fips, neuvector, cluster-autoscaler-fips, neuvector-scanner,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: teleport, grafana-alloy-fips, bento-fips, kots, grafana-alloy, splunk-otel-collector-fips, steampipe, bento, telegraf, splunk-otel-collector...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: keda, argo-workflows-fips, grafana-alloy, kargo, argo-cd, eks-distro, opentelemetry-collector-fips, grafana-alloy-fips, k8sgpt, amazon-cloudwatch-agent-fips, splunk-otel-collector-fips, tempo, argo-cd-fips, eks-distro-fips, nats, opentelemetry-collector-contrib-fips,...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy, opentelemetry-collector-contrib, splunk-otel-collector, sqlexporter...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: trivy-operator, terragrunt, steampipe, kubescape-operator, opentofu, nuclei, nsc, filebrowser, podman, rancher-fleet, guac, terraform, grafana-alloy, xeol, gptscript, gitleaks, vcluster, tflint, zot, gitness, envoy-gateway, k9s, trufflehog, undock, trivy, zarf...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: maru, terragrunt, rclone, goreleaser, k3s, lazygit, ollama, witness, grafana, nuclei, redpanda, prometheus, weaviate, mcp-grafana, dagger, minio, loki, datadog-agent, grafana-alloy, opentelemetry-collector-contrib, tempo, vcluster, malcontent, teleport, k8sgpt, nfpm,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: grafana-alloy, kubernetes, podman, falco-no-driver, node-feature-discovery, nvidia-container-toolkit, k3s, sriov-network-device-plugin, buildah...
GO-2025-4096 vulnerabilities
Vulnerabilities for packages: grafana-alloy, kubernetes, podman, falco-no-driver, node-feature-discovery, nvidia-container-toolkit, k3s, sriov-network-device-plugin, buildah...