CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, sqlexporter, splunk-otel-collector-fips, vault, grafana-alloy, splunk-otel-collector, sqlexporter-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, commercial-grafana, grafana-alloy, grafana-fips, grafana...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, runc, neuvector-scanner, ctop, gosu, podman, cluster-autoscaler, grafana-alloy, cluster-autoscaler-fips, syft, neuvector-fips, opentelemetry-collector-contrib, grafana-alloy-fips, grype, kubernetes, docker, neuvector-scanner-fips,...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, telegraf, splunk-otel-collector-fips, steampipe, grafana-alloy, splunk-otel-collector, teleport, kots, bento-fips, bento...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, nats, argo-rollouts, splunk-otel-collector-fips, opentelemetry-collector, argo-workflows, grafana-alloy, splunk-otel-collector, kubeflow-pipelines, k8sgpt, opentelemetry-collector-contrib, grafana-alloy-fips, keda, argo-rollouts-fips,...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana, grafana-alloy...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, sqlexporter, opentelemetry-collector-contrib, grafana-alloy...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: filebrowser, k9s, gptscript, steampipe, grafana-alloy, gitness, xeol, nsc, podman, gitleaks, trufflehog, undock, vcluster, trivy-operator, zarf, trivy, terraform, kubescape-operator, nuclei, envoy-gateway, rancher-fleet, terragrunt, guac, opentofu, tflint, zot...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: grafana, nfpm, redpanda, lazygit, kubevela, dagger, grafana-alloy, dgraph, k3s, malcontent, eksctl, rclone, terraform-mcp-server, vcluster, maru, datadog-agent, k8sgpt, mcp-grafana, loki, opentelemetry-collector-contrib, prometheus, tempo, nuclei, gitlab-runner,...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: kubernetes, nvidia-container-toolkit, podman, falco-no-driver, sriov-network-device-plugin, grafana-alloy, node-feature-discovery, k3s, buildah...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: kubernetes, nvidia-container-toolkit, podman, falco-no-driver, sriov-network-device-plugin, grafana-alloy, node-feature-discovery, k3s, buildah...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, kubernetes, syft, podman, docker, neuvector-scanner, runc, ctop, grafana-alloy, cadvisor, k8s-device-plugin, k3s, buildah, grype...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, kots, steampipe, telegraf, grafana-alloy, bento...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, skaffold, snyk-cli, k9s, gptscript, kubevela, dagger, grafana-alloy, flux, osv-scanner, tfsec, task, syft, chezmoi, crossplane, pulumi-language-dotnet, gitsign, go-licenses, kargo, apko, timoni, k8sgpt, grype, melange, trivy, bom, zarf,...