122 matches found
CLEANSTART-2026-NK57336 go-git is an extensible git implementation library written in pure Go
Multiple security vulnerabilities affect the grafana-alloy package. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, splunk-otel-collector-fips, splunk-otel-collector, vault, opentelemetry-collector-contrib, sqlexporter, opentelemetry-collector-contrib-fips, sqlexporter-fips, grafana-alloy...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-fips, grafana-alloy-fips, grafana, commercial-grafana, grafana-alloy...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: neuvector, cluster-autoscaler, eks-distro, syft, k8s-device-plugin, neuvector-scanner, docker, grype, kubernetes, grafana-alloy-fips, podman, ctop, cadvisor, cadvisor-fips, k3s, opentelemetry-collector-contrib, eks-distro-fips, runc, gosu, grafana-alloy,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: teleport, grafana-alloy-fips, bento, splunk-otel-collector, splunk-otel-collector-fips, bento-fips, steampipe, kots, telegraf, grafana-alloy...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: argo-cd, eks-distro, opentelemetry-collector, k8sgpt, kargo, amazon-cloudwatch-agent-fips, grafana-alloy-fips, argo-cd-fips, splunk-otel-collector-fips, argo-rollouts, splunk-otel-collector, argo-rollouts-fips, amazon-cloudwatch-agent, argo-workflows,...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: sqlexporter, opentelemetry-collector-contrib, grafana-alloy, splunk-otel-collector...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: envoy-gateway, undock, kubescape-operator, vcluster, filebrowser, trivy, steampipe, grafana-alloy, nuclei, podman, tflint, terragrunt, k9s, guac, gitleaks, trufflehog, xeol, opentofu, nsc, gitness, rancher-fleet, gptscript, zot, zarf, terraform, trivy-operator...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: malcontent, vcluster, terraform-mcp-server, tempo, minio, teleport, grafana-alloy, nuclei, opentelemetry-collector, opentelemetry-collector-contrib, redpanda, terragrunt, dgraph, eksctl, gitlab-runner, loki, witness, grafana, goreleaser, cri-tools, maru, k3s, lazygit...