Alloy vulnerabilities

2 known vulnerabilities in Alloy from Grafana. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.7 High severity

  Alloy: Files or Directories Accessible to External Parties

  CVE-2026-75889Aug 27, 2026Grafana

  Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a be

• 7.8 High severity

  Alloy: Unquoted Search Path or Element

  CVE-2024-8975Sep 25, 2024Grafana

  Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.