115 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: vault, grafana-alloy-fips, splunk-otel-collector-fips, splunk-otel-collector, opentelemetry-collector-contrib, sqlexporter, sqlexporter-fips, opentelemetry-collector-contrib-fips, grafana-alloy...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy-fips, grafana-fips, commercial-grafana, grafana-alloy...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: grype, neuvector, k3s, neuvector-scanner-fips, podman, docker, k8s-device-plugin, cadvisor, opentelemetry-collector-contrib, runc, cluster-autoscaler, opentelemetry-collector-contrib-fips, eks-distro-fips, cluster-autoscaler-fips, node-feature-discovery,...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: steampipe, grafana-alloy-fips, teleport, splunk-otel-collector-fips, bento-fips, splunk-otel-collector, telegraf, kots, bento, grafana-alloy...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: tempo, opentelemetry-collector, kubeflow-pipelines, amazon-cloudwatch-agent-fips, keda, opentelemetry-collector-contrib, kargo, argo-cd, opentelemetry-collector-contrib-fips, argo-rollouts-fips, nats, argo-rollouts, eks-distro-fips, argo-workflows,...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, splunk-otel-collector, sqlexporter, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana, grafana-alloy...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: gptscript, k9s, trufflehog, filebrowser, rancher-fleet, nuclei, kubescape-operator, zarf, gitleaks, envoy-gateway, xeol, grafana-alloy, opentofu, terraform, trivy, zot, gitness, vcluster, guac, undock, trivy-operator, nsc, podman, steampipe, terragrunt, tflint...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: mcp-grafana, gitlab-runner, datadog-agent, k3s, nuclei, dgraph, terraform-mcp-server, teleport, goreleaser, tempo, grafana-alloy, dagger, minio, cri-tools, k8sgpt, eksctl, ollama, kubevela, vcluster, grafana, redpanda, loki, opentelemetry-collector, weaviate,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: sriov-network-device-plugin, buildah, podman, falco-no-driver, grafana-alloy, node-feature-discovery, kubernetes, k3s, nvidia-container-toolkit...