CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: grafana-alloy, sqlexporter-fips, opentelemetry-collector-contrib, grafana-alloy-fips, vault, splunk-otel-collector, sqlexporter, splunk-otel-collector-fips, opentelemetry-collector-contrib-fips...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy, commercial-grafana, grafana-alloy-fips, grafana-fips, grafana...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: runc, grafana-alloy, node-feature-discovery, buildah, k3s, cadvisor-fips, k8s-device-plugin, opentelemetry-collector-contrib, grafana-alloy-fips, podman, syft, eks-distro, cluster-autoscaler, gosu, ctop, eks-distro-fips, kubernetes, grype, docker, neuvector,...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: grafana-alloy, bento-fips, telegraf, bento, grafana-alloy-fips, steampipe, teleport, kots, splunk-otel-collector, splunk-otel-collector-fips...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: grafana-alloy, argo-rollouts-fips, nats, k8sgpt, opentelemetry-collector-contrib, grafana-alloy-fips, argo-cd, argo-workflows-fips, eks-distro, amazon-cloudwatch-agent, eks-distro-fips, opentelemetry-collector-fips, opentelemetry-collector, splunk-otel-collector-fips...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, sqlexporter, opentelemetry-collector-contrib, grafana-alloy...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: podman, vcluster, trivy, gitness, trufflehog, zarf, undock, gptscript, grafana-alloy, nsc, guac, steampipe, nuclei, tflint, trivy-operator, gitleaks, filebrowser, terragrunt, rancher-fleet, envoy-gateway, kubescape-operator, opentofu, xeol, zot, terraform, k9s...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: nfpm, teleport, vcluster, mcp-grafana, gitlab-runner, eksctl, ollama, goreleaser, grafana-alloy, terraform-mcp-server, witness, rclone, opentelemetry-collector, grafana, datadog-agent, k8sgpt, nuclei, redpanda, opentelemetry-collector-contrib, k3s, minio, malcontent,...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: podman, node-feature-discovery, grafana-alloy, k3s, buildah, nvidia-container-toolkit, kubernetes, sriov-network-device-plugin, falco-no-driver...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: podman, node-feature-discovery, grafana-alloy, k3s, buildah, nvidia-container-toolkit, kubernetes, sriov-network-device-plugin, falco-no-driver...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: podman, ctop, runc, opentelemetry-collector-contrib, grafana-alloy, k3s, grype, buildah, syft, neuvector-scanner, kubernetes, k8s-device-plugin, docker, cadvisor...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: telegraf, steampipe, grafana-alloy, kots, splunk-otel-collector, bento...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: kargo, melange, bom, kots, trivy, pulumi-language-yaml, wolfictl, src-fingerprint, gitsign, zarf, gptscript, tfsec, goreleaser, grafana-alloy, k9s, flux-source-controller, flux-kustomize-controller, argocd-image-updater, kaniko, pulumi,...