CVE-2026-75889

Description

Grafana Alloy-s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy-s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy-s service account.