121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib-fips, grafana-alloy, sqlexporter, vault, splunk-otel-collector, opentelemetry-collector-contrib, grafana-alloy-fips, splunk-otel-collector-fips, sqlexporter-fips...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, commercial-grafana, grafana-alloy-fips, grafana-fips, grafana...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: cluster-autoscaler-fips, neuvector-fips, ctop, kubernetes-fips, cadvisor, gosu, opentelemetry-collector-contrib-fips, grafana-alloy, kubernetes, buildah, grafana-alloy-fips, syft, neuvector-scanner-fips, grype, k8s-device-plugin, cadvisor-fips,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: bento, grafana-alloy, steampipe, telegraf, kots, splunk-otel-collector, grafana-alloy-fips, teleport, splunk-otel-collector-fips, bento-fips...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: argo-rollouts, k8sgpt, tempo, kargo, amazon-cloudwatch-agent-fips, opentelemetry-collector-contrib-fips, grafana-alloy, amazon-cloudwatch-agent, argo-workflows-fips, keda, grafana-alloy-fips, argo-cd-fips, opentelemetry-collector-fips, nats, argo-rollouts-fips,...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, opentelemetry-collector-contrib, grafana-alloy, sqlexporter...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: gptscript, trufflehog, terragrunt, kubescape-operator, k9s, gitness, guac, zot, nsc, steampipe, undock, gitleaks, rancher-fleet, tflint, grafana-alloy, filebrowser, xeol, trivy-operator, trivy, vcluster, terraform, zarf, podman, envoy-gateway, nuclei, opentofu...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector, mcp-grafana, gitlab-runner, lazygit, terragrunt, maru, grafana, dagger, minio, opentelemetry-collector-contrib, terraform-mcp-server, prometheus, goreleaser, dgraph, loki, k3s, grafana-alloy, tempo, redpanda, k8sgpt, weaviate, teleport,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: buildah, kubernetes, falco-no-driver, podman, nvidia-container-toolkit, k3s, grafana-alloy, sriov-network-device-plugin, node-feature-discovery...