Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestions search

With package: alloy5

Found 1 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-75889
7.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 2 weeks, 6 days ago Activity log
  • Created suggestion
CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy’s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy’s service account.

Affected products

Alloy
  • =<1.18.1

Matching in nixpkgs

pkgs.alloy

Language & tool for relational models

  • nixos-unstable -
    • nixos-unstable-small 5.1.0
  • nixos-26.05 -
    • nixos-26.05-small 5.1.0

pkgs.alloy5

Language & tool for relational models

  • nixos-unstable -
    • nixos-unstable-small 5.1.0
  • nixos-26.05 -
    • nixos-26.05-small 5.1.0

pkgs.alloy6

Language & tool for relational models

  • nixos-unstable -
    • nixos-unstable-small 6.2.0
  • nixos-26.05 -
    • nixos-26.05-small 6.2.0

pkgs.halloy

IRC application

  • nixos-unstable -
  • nixos-26.05 -

pkgs.grafana-alloy

OpenTelemetry Collector distribution with programmable pipelines

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers