Grafana Alloy CVE-2026-75889 lets bearerTokenFile read any local file and leak it

Grafana Alloy contains CVE-2026-75889 (CVSS 7.7): the bearerTokenFile setting accepted an arbitrary path, so the agent read that file and sent its contents to a remote endpoint as an Authorization header. The flaw is worse where the scraping configuration is writable by anyone who can reach the config API rather than by the host administrator.

• The flaw is rated CVSS 7.7 and fixed in a Grafana release
• Attackers can read cloud credentials, Kubernetes tokens and TLS private keys
• Exfiltration looks like an ordinary outbound scraping request
• The Alloy config API is unauthenticated in some deployments