121 matches found
CVE-2026-75889
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889
Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
EUVD-2026-67162
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib-fips, grafana-alloy-fips, splunk-otel-collector-fips, splunk-otel-collector, vault, grafana-alloy, sqlexporter, sqlexporter-fips, opentelemetry-collector-contrib...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, grafana-alloy, grafana-fips, grafana, commercial-grafana...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: kubernetes-fips, ctop, gosu, cluster-autoscaler-fips, neuvector-fips, buildah, grype, k3s, opentelemetry-collector-contrib, eks-distro-fips, grafana-alloy-fips, opentelemetry-collector-contrib-fips, cadvisor-fips, neuvector-scanner-fips, docker, kubernetes, neuvector...
GO-2026-4518 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, splunk-otel-collector-fips, splunk-otel-collector, steampipe, grafana-alloy, kots, bento, telegraf, bento-fips, teleport...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: kargo, amazon-cloudwatch-agent-fips, keda, opentelemetry-collector-contrib, eks-distro-fips, grafana-alloy-fips, argo-rollouts-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-fips, splunk-otel-collector-fips, argo-workflows-fips, tempo,...
GO-2026-5115 vulnerabilities
Vulnerabilities for packages: grafana-alloy, grafana...
GO-2024-3066 vulnerabilities
Vulnerabilities for packages: grafana-alloy...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, splunk-otel-collector, grafana-alloy, sqlexporter...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: grafana-alloy, podman, trufflehog, vcluster, rancher-fleet, nuclei, tflint, undock, nsc, gptscript, terragrunt, guac, trivy, trivy-operator, xeol, k9s, gitness, envoy-gateway, zot, filebrowser, zarf, kubescape-operator, steampipe, opentofu, terraform, gitleaks...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: grafana-alloy, ollama, eksctl, grafana, k3s, dgraph, redpanda, opentelemetry-collector-contrib, k8sgpt, vcluster, minio, nuclei, datadog-agent, nfpm, opentelemetry-collector, goreleaser, kubevela, terragrunt, mcp-grafana, tempo, witness, prometheus, dagger, lazygit,...
GO-2025-4097 vulnerabilities
Vulnerabilities for packages: grafana-alloy, nvidia-container-toolkit, podman, node-feature-discovery, k3s, kubernetes, sriov-network-device-plugin, falco-no-driver, buildah...