VulnSocial

CVE-2026-75889Patch

LOWCVSS 7.7 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy’s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy’s service account.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-552

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-01); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-01: 1Mentions · 2026-09-17: 1PoC Mentioned / Linked · 2026-09-17: 1Patch / Workaround · 2026-09-01: 1Patch / Workaround · 2026-09-17: 1Technical Details · 2026-09-01: 1Technical Details · 2026-09-17: 109-0109-17
Signal classification1 categories
Patch
2100.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
  • CyStack@CyStackSecurity
    Patch

    CVE-2026-75889: Arbitrary file read in Grafana Alloy, the open-source telemetry agent from Grafana Labs that runs inside Kubernetes. ServiceMonitor's bearerTokenFile field carries straight through into the scrape job. Point it at Alloy's own service account token, aim the scrape target at a server you control, and Alloy hands over its own credentials. Patched in v1.19.0. Found by a CyStack researcher. Details at https://cystack.net/disclosures

    Post summary

    The tweet reports CVE‑2026‑75889 as an arbitrary file read in Grafana Alloy, confirms a patch in v1.19.0, and provides a link to further details, indicating a PoC is available.

    0000081
    3.7K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-75889 (CVSS 7.7) - Grafana Alloy file disclosure via ServiceMonitor manipulation. Attackers with ServiceMonitor write access can exfiltrate local files including K8s tokens. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/VHVWZWjQPy

    Post summary

    The tweet announces a high‑severity file‑disclosure vulnerability (CVE‑2026‑75889) in Grafana Alloy, urges immediate patching, and provides technical details such as CVSS score and attack vector.

    0000046
    121 followersView on X

Explore more

Back to dashboard