121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: sqlexporter, splunk-otel-collector-fips, grafana-alloy-fips, grafana-alloy, vault, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib, sqlexporter-fips, splunk-otel-collector...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-fips, grafana-alloy, grafana, commercial-grafana...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: cluster-autoscaler, cluster-autoscaler-fips, k8s-device-plugin, kubernetes, eks-distro-fips, buildah, kubernetes-fips, grype, grafana-alloy-fips, neuvector-scanner, cadvisor, neuvector, syft, neuvector-fips, opentelemetry-collector-contrib-fips, k3s, podman,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector-fips, grafana-alloy-fips, bento-fips, telegraf, grafana-alloy, kots, bento, teleport, splunk-otel-collector, steampipe...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: argo-rollouts-fips, argo-workflows, eks-distro-fips, splunk-otel-collector, argo-cd, grafana-alloy-fips, nats, argo-workflows-fips, kubeflow-pipelines, argo-rollouts, opentelemetry-collector-contrib-fips, eks-distro, kargo, k8sgpt, amazon-cloudwatch-agent,...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, sqlexporter, grafana-alloy, splunk-otel-collector...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: filebrowser, xeol, guac, tflint, undock, steampipe, gitness, zarf, envoy-gateway, zot, kubescape-operator, trivy, terragrunt, trufflehog, podman, terraform, grafana-alloy, vcluster, trivy-operator, opentofu, nuclei, k9s, nsc, rancher-fleet, gptscript, gitleaks...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: mcp-grafana, k8sgpt, opentelemetry-collector-contrib, gitlab-runner, rclone, ollama, loki, prometheus, dgraph, k3s, nfpm, terragrunt, cri-tools, dagger, grafana, witness, eksctl, datadog-agent, weaviate, minio, grafana-alloy, redpanda, teleport, vcluster, lazygit,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: nvidia-container-toolkit, node-feature-discovery, podman, falco-no-driver, buildah, sriov-network-device-plugin, k3s, kubernetes, grafana-alloy...