121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: sqlexporter, vault, opentelemetry-collector-contrib, sqlexporter-fips, splunk-otel-collector-fips, opentelemetry-collector-contrib-fips, grafana-alloy, splunk-otel-collector, grafana-alloy-fips...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-fips, commercial-grafana, grafana-alloy, grafana-alloy-fips...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: neuvector, neuvector-fips, neuvector-scanner, k3s, neuvector-scanner-fips, syft, kubernetes, opentelemetry-collector-contrib, eks-distro-fips, cluster-autoscaler-fips, gosu, kubernetes-fips, podman, cluster-autoscaler, docker, k8s-device-plugin, grafana-alloy-fips,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: telegraf, bento, kots, bento-fips, splunk-otel-collector-fips, steampipe, grafana-alloy, splunk-otel-collector, grafana-alloy-fips, teleport...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: k8sgpt, argo-rollouts-fips, argo-rollouts, argo-workflows, opentelemetry-collector-contrib, keda, eks-distro-fips, opentelemetry-collector, argo-cd, kubeflow-pipelines, argo-cd-fips, amazon-cloudwatch-agent-fips, splunk-otel-collector-fips, splunk-otel-collector,...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, opentelemetry-collector-contrib, grafana-alloy, sqlexporter...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: terragrunt, trufflehog, gptscript, k9s, kubescape-operator, zarf, grafana-alloy, trivy, xeol, filebrowser, guac, undock, zot, trivy-operator, rancher-fleet, gitleaks, steampipe, nuclei, opentofu, gitness, tflint, terraform, envoy-gateway, nsc, vcluster, podman...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: malcontent, dagger, rclone, grafana, terragrunt, k3s, cri-tools, lazygit, grafana-alloy, loki, dgraph, prometheus, opentelemetry-collector, mcp-grafana, tempo, weaviate, minio, redpanda, k8sgpt, terraform-mcp-server, maru, nuclei, kubevela, nfpm, goreleaser, teleport...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: buildah, sriov-network-device-plugin, k3s, falco-no-driver, kubernetes, nvidia-container-toolkit, node-feature-discovery, grafana-alloy, podman...