CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, sqlexporter, grafana-alloy-fips, grafana-alloy, opentelemetry-collector-contrib-fips, splunk-otel-collector-fips, splunk-otel-collector, sqlexporter-fips, vault...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy, commercial-grafana, grafana-fips, grafana...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler, neuvector, grafana-alloy, eks-distro, cluster-autoscaler-fips, k8s-device-plugin, runc, eks-distro-fips, opentelemetry-collector-contrib-fips, kubernetes-fips, docker, ctop, neuvector-scanner-fips, grype, syft, neuvector-scanner, neuvector-fips,...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, bento-fips, grafana-alloy, teleport, bento, kots, splunk-otel-collector-fips, telegraf, splunk-otel-collector, steampipe...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: argo-cd, grafana-alloy, amazon-cloudwatch-agent-fips, eks-distro, splunk-otel-collector-fips, opentelemetry-collector-fips, nats, eks-distro-fips, opentelemetry-collector-contrib-fips, tempo, amazon-cloudwatch-agent, k8sgpt, argo-workflows-fips, argo-rollouts-fips,...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: grafana-alloy, sqlexporter, opentelemetry-collector-contrib, splunk-otel-collector...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana, grafana-alloy...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: terragrunt, undock, vcluster, grafana-alloy, podman, filebrowser, terraform, trivy, gptscript, gitness, trufflehog, nsc, trivy-operator, guac, steampipe, xeol, opentofu, zot, tflint, envoy-gateway, nuclei, zarf, kubescape-operator, rancher-fleet, k9s, gitleaks...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, minio, maru, terragrunt, grafana-alloy, vcluster, opentelemetry-collector-contrib, nfpm, cri-tools, tempo, eksctl, kubevela, witness, lazygit, prometheus, teleport, rclone, loki, dgraph, weaviate, dagger, redpanda, gitlab-runner, datadog-agen...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit, falco-no-driver, grafana-alloy, buildah, podman, kubernetes, node-feature-discovery, k3s, sriov-network-device-plugin...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit, falco-no-driver, grafana-alloy, buildah, podman, kubernetes, node-feature-discovery, k3s, sriov-network-device-plugin...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: docker, grafana-alloy, buildah, opentelemetry-collector-contrib, podman, kubernetes, runc, syft, neuvector-scanner, k8s-device-plugin, grype, k3s, ctop, cadvisor...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: telegraf, kots, grafana-alloy, splunk-otel-collector, steampipe, bento...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: snyk-cli, grafana-alloy, pulumi-language-dotnet, timoni, kubescape, syft, flux, kubevela, gptscript, trivy, pulumi-kubernetes-operator, gitea, gitsign, bom, guac, src-fingerprint, argo-events, flux-image-automation-controller, chezmoi, wolfictl, flux-source-controlle...