CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: vault, opentelemetry-collector-contrib, grafana-alloy-fips, opentelemetry-collector-contrib-fips, grafana-alloy, splunk-otel-collector, sqlexporter-fips, sqlexporter, splunk-otel-collector-fips...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana-alloy-fips...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-fips, commercial-grafana, grafana-alloy-fips, grafana-alloy, grafana...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, node-feature-discovery, podman, docker, grafana-alloy-fips, gosu, ctop, neuvector, neuvector-scanner-fips, cadvisor-fips, k3s, grafana-alloy, opentelemetry-collector-contrib-fips, neuvector-fips, eks-distro, grype, cluster-autoscaler, kubernetes,...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: bento, steampipe, telegraf, teleport, kots, grafana-alloy-fips, bento-fips, grafana-alloy, splunk-otel-collector, splunk-otel-collector-fips...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent-fips, amazon-cloudwatch-agent, grafana-alloy-fips, kubeflow-pipelines, argo-rollouts-fips, splunk-otel-collector, tempo, nats, opentelemetry-collector-contrib-fips, grafana-alloy, opentelemetry-collector, eks-distro, splunk-otel-collector-fips...

GO-2026-5115 vulnerabilities

Vulnerabilities for packages: grafana-alloy, grafana...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, sqlexporter, grafana-alloy, opentelemetry-collector-contrib...

GO-2024-3066 vulnerabilities

Vulnerabilities for packages: grafana-alloy...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: envoy-gateway, filebrowser, tflint, grafana-alloy, gitness, gptscript, zot, gitleaks, trivy-operator, rancher-fleet, podman, steampipe, undock, zarf, nuclei, k9s, guac, kubescape-operator, vcluster, xeol, trivy, opentofu, trufflehog, nsc, terragrunt, terraform...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: redpanda, mcp-grafana, goreleaser, tempo, rclone, grafana-alloy, datadog-agent, cri-tools, nfpm, terraform-mcp-server, dgraph, eksctl, witness, k8sgpt, lazygit, ollama, opentelemetry-collector, nuclei, minio, maru, loki, opentelemetry-collector-contrib, prometheus,...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit, buildah, node-feature-discovery, falco-no-driver, kubernetes, podman, k3s, sriov-network-device-plugin, grafana-alloy...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit, buildah, node-feature-discovery, falco-no-driver, kubernetes, podman, k3s, sriov-network-device-plugin, grafana-alloy...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, runc, docker, buildah, grype, opentelemetry-collector-contrib, podman, neuvector-scanner, kubernetes, cadvisor, k3s, syft, grafana-alloy, ctop...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: kots, telegraf, splunk-otel-collector, steampipe, bento, grafana-alloy...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: wolfictl, kaniko, goreleaser, melange, kargo, gitea, src-fingerprint, grafana-alloy, gptscript, zot, grype, apko, pulumi-language-yaml, argo-workflows, pulumi, flux-image-automation-controller, kubescape, chezmoi, k8sgpt, pulumi-kubernetes-operator,...