114 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: sqlexporter, splunk-otel-collector, grafana-alloy-fips, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, splunk-otel-collector-fips, sqlexporter-fips, vault, grafana-alloy...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: commercial-grafana, grafana-alloy-fips, grafana, grafana-fips, grafana-alloy...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: docker, podman, grype, neuvector-scanner-fips, k8s-device-plugin, grafana-alloy, node-feature-discovery, kubernetes, eks-distro, neuvector-scanner, kubernetes-fips, gosu, cluster-autoscaler, opentelemetry-collector-contrib, runc, cadvisor, buildah, neuvector, ctop,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: teleport, splunk-otel-collector, grafana-alloy-fips, steampipe, splunk-otel-collector-fips, bento, telegraf, grafana-alloy, kots, bento-fips...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: argo-workflows-fips, opentelemetry-collector, splunk-otel-collector-fips, amazon-cloudwatch-agent, keda, kubeflow-pipelines, grafana-alloy, k8sgpt, argo-cd-fips, kargo, argo-rollouts-fips, nats, argo-rollouts, eks-distro, tempo, argo-workflows,...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, sqlexporter, splunk-otel-collector, grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: vcluster, kubescape-operator, trivy-operator, rancher-fleet, k9s, gitleaks, trufflehog, nuclei, guac, nsc, zot, undock, trivy, tflint, filebrowser, grafana-alloy, terragrunt, xeol, terraform, zarf, podman, gptscript, steampipe, gitness, envoy-gateway, opentofu...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: mcp-grafana, vcluster, cri-tools, k8sgpt, teleport, goreleaser, tempo, nuclei, terraform-mcp-server, lazygit, prometheus, grafana, weaviate, opentelemetry-collector, ollama, dgraph, maru, dagger, grafana-alloy, redpanda, nfpm, terragrunt, k3s, rclone,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: node-feature-discovery, buildah, kubernetes, grafana-alloy, nvidia-container-toolkit, sriov-network-device-plugin, k3s, podman, falco-no-driver...
GO-2025-4096 vulnerabilities
Vulnerabilities for packages: node-feature-discovery, buildah, kubernetes, grafana-alloy, nvidia-container-toolkit, sriov-network-device-plugin, k3s, podman, falco-no-driver...