CVE-2026-75889: Vulnerability in Grafana Alloy

The vulnerability in Grafana Alloy's prometheus.operator.servicemonitors component arises from the ability of a user with ServiceMonitor write permissions to specify an arbitrary local file through the bearerTokenFile parameter. Alloy reads the specified file and sends its contents as a bearer token to a scrape endpoint controlled by the attacker. This behavior can lead to disclosure of files accessible by the Alloy process, including the projected Kubernetes service account token, which may allow the attacker to gain Alloy's Kubernetes permissions. The vulnerability affects version 1.0.0 of Grafana Alloy. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to disclosure of sensitive local files accessible by the Alloy process, including the Kubernetes service account token. This may allow an attacker to escalate privileges by gaining Alloy's Kubernetes permissions. The vulnerability requires the attacker to have write access to ServiceMonitor resources in a watched namespace, which is a lower privilege than Alloy's service account. There is no indication of impact on integrity or availability, only confidentiality is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to ServiceMonitor resources to trusted users only to prevent exploitation. Monitor for unauthorized modifications to ServiceMonitor resources.