CVE-2026-75889 CVE-2026-75889 CVE Record
Attackers with ServiceMonitor write access can read arbitrary local files via bearerTokenFile, potentially stealing Kubernetes service account tokens.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75889?
CVE-2026-75889 is a high-severity path traversal vulnerability in Grafana Alloy, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy’s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy’s service account.
Weakness: CWE-552
Which versions are affected by CVE-2026-75889?
1 open source package ship an affected version, including grafana-alloy.
| Package | Affected | Fixed in |
|---|---|---|
grafana-alloy Bitnami | From 1.0.0 | 1.19.0 |
How do I fix CVE-2026-75889?
Upgrade grafana-alloy to 1.19.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-75889 being exploited?
There is no known exploitation of CVE-2026-75889 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-alloy-2026-75889, GHSA-6vgr-r2fg-p38q.