121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, grafana-alloy, sqlexporter, sqlexporter-fips, splunk-otel-collector-fips, splunk-otel-collector, vault...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy, grafana-fips, commercial-grafana, grafana...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: k8s-device-plugin, cadvisor-fips, opentelemetry-collector-contrib, runc, opentelemetry-collector-contrib-fips, eks-distro-fips, neuvector-scanner, cluster-autoscaler, neuvector-scanner-fips, syft, eks-distro, neuvector-fips, ctop, cadvisor, k3s, docker, buildah,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, bento-fips, kots, grafana-alloy, telegraf, bento, splunk-otel-collector-fips, splunk-otel-collector, teleport, steampipe...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, kubeflow-pipelines, eks-distro-fips, argo-cd, argo-cd-fips, amazon-cloudwatch-agent-fips, eks-distro, amazon-cloudwatch-agent, argo-workflows-fips, nats, argo-rollouts-fips, keda,...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: sqlexporter, splunk-otel-collector, opentelemetry-collector-contrib, grafana-alloy...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: vcluster, trivy-operator, undock, guac, opentofu, steampipe, k9s, grafana-alloy, xeol, trufflehog, podman, gptscript, terraform, envoy-gateway, nsc, nuclei, trivy, kubescape-operator, rancher-fleet, gitness, zarf, filebrowser, zot, terragrunt, tflint, gitleaks...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: vcluster, minio, malcontent, ollama, terraform-mcp-server, kubevela, redpanda, gitlab-runner, goreleaser, grafana-alloy, nfpm, datadog-agent, opentelemetry-collector, grafana, prometheus, lazygit, mcp-grafana, rclone, dgraph, dagger, nuclei, tempo, witness, maru,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: podman, nvidia-container-toolkit, kubernetes, grafana-alloy, buildah, node-feature-discovery, falco-no-driver, k3s, sriov-network-device-plugin...