114 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, grafana-alloy-fips, opentelemetry-collector-contrib-fips, splunk-otel-collector, splunk-otel-collector-fips, grafana-alloy, sqlexporter, sqlexporter-fips, vault...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, commercial-grafana, grafana-alloy, grafana, grafana-fips...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: k8s-device-plugin, node-feature-discovery, runc, docker, ctop, cluster-autoscaler, neuvector, neuvector-fips, k3s, cluster-autoscaler-fips, kubernetes-fips, opentelemetry-collector-contrib, neuvector-scanner-fips, grafana-alloy-fips, syft, podman, eks-distro-fips,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, teleport, telegraf, bento-fips, splunk-otel-collector, splunk-otel-collector-fips, steampipe, bento, grafana-alloy, kots...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: argo-cd, kargo, amazon-cloudwatch-agent, kubeflow-pipelines, argo-rollouts, k8sgpt, splunk-otel-collector-fips, argo-rollouts-fips, tempo, amazon-cloudwatch-agent-fips, opentelemetry-collector-contrib, grafana-alloy-fips, opentelemetry-collector, argo-cd-fips,...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy, sqlexporter, opentelemetry-collector-contrib, splunk-otel-collector...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: vcluster, rancher-fleet, tflint, filebrowser, opentofu, grafana-alloy, guac, trufflehog, gptscript, terragrunt, xeol, kubescape-operator, gitness, undock, gitleaks, zot, podman, k9s, zarf, envoy-gateway, nuclei, steampipe, trivy, nsc, trivy-operator, terraform...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: vcluster, k3s, tempo, nfpm, opentelemetry-collector-contrib, rclone, opentelemetry-collector, teleport, eksctl, k8sgpt, dagger, grafana-alloy, weaviate, datadog-agent, loki, prometheus, terragrunt, maru, kubevela, terraform-mcp-server, mcp-grafana, grafana, ollama,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: grafana-alloy, k3s, nvidia-container-toolkit, podman, node-feature-discovery, falco-no-driver, kubernetes, buildah, sriov-network-device-plugin...
GO-2025-4096 vulnerabilities
Vulnerabilities for packages: grafana-alloy, k3s, nvidia-container-toolkit, podman, node-feature-discovery, falco-no-driver, kubernetes, buildah, sriov-network-device-plugin...