Grafana Alloy flaw let crafted bearerTokenFile paths leak local files via auth headers

What happened

Grafana Alloy, the company's open-source telemetry agent, contained a vulnerability in the way it resolves bearer token files used for Prometheus-style scraping. The flaw, tracked as CVE-2026-75889, meant the bearerTokenFile setting was accepted at face value: a configuration pointing at a sensitive file caused Alloy to read that file and transmit its contents to a remote endpoint inside an Authorization header. According to an analysis on dev.to, the issue is scored 7.7 on the CVSS scale and arrived in the same advisory wave as several higher-rated Grafana problems, which may explain the limited attention it received.

Why the path mattered

Reading a token from disk is routine for a scraper; the real question is who gets to choose the path. As the dev.to write-up explains, Alloy's scraping configuration is typically written by whoever can reach the configuration API or the configuration repository, not necessarily whoever administers the host. Once that path can be influenced by an attacker, the result is an arbitrary local file read with outbound delivery included: Alloy ships the file's contents to whatever target it has been told to scrape, and the target address comes from the same attacker-controlled configuration.

What was exposed

Because the agent runs as a service with a stable identity, the files it can read are unusually valuable. The dev.to article lists what sits within reach on a typical deployment: cloud credential files and workload identity tokens, which translate directly into API access; the Alloy configuration itself, holding remote-write endpoints, Grafana Cloud API keys and credentials for every integration being scraped; Kubernetes service account tokens when the agent runs as a DaemonSet with a mounted token; TLS private keys where mutual TLS is terminated or originated; and environment or compose files, which often carry database passwords for the very services under observation. The author's broader point is that an observability agent is often the one component with network access to the entire estate, so its configuration doubles as an inventory of the organisation's secrets.

How attackers reach the setting

A file-read bug on its own has limited reach; the reason this one matters is the route to the write side. The dev.to analysis notes that Alloy's configuration API is reachable without authentication in some deployments, on the assumption that it sits on an internal interface. Combined with a UI feature that renders configuration fragments, or a repository that accepts outside contributions, the ability to set a file path becomes available to someone well below host-administrator level. The lesson the piece draws is general: telemetry agents take instructions from somewhere by design, and if that somewhere shares a network with the dashboards, the agent's privileges effectively belong to anyone able to submit a configuration fragment.

What operators should do

The write-up sets out containment steps that apply regardless of patch status:

• Search configurations for bearer_token_file and related path settings, and confirm each one points inside a dedicated secrets directory rather than to an arbitrary location on disk.
• Verify that the configuration API requires authentication and is not bound to every interface; treat it as an administrative endpoint.
• Review outbound connections from the agent for destinations that are neither scrape targets nor remote-write endpoints, since exfiltration here resembles normal scraping.
• Rotate any credential the agent process could read if an affected version ran with a reachable configuration path.
• Run the agent with a read-only root filesystem, short-lived projected tokens, and a mount set that excludes the rest of the host.

The Grafana security advisory referenced by the article identifies a fixed release, though the dev.to post does not name the specific version, so operators should consult the advisory directly before patching.

Why it matters

This bug is a compact demonstration of how observability tooling becomes an attack path. Agents like Alloy are handed broad read access and network reach on purpose, and their configurations change dynamically by design. CVE-2026-75889 shows that whoever controls that configuration controls both what a privileged process reads and where it sends the result, wrapped in traffic that blends in as routine telemetry. A 7.7 rating inside a crowded advisory cycle makes it exactly the kind of issue that quietly misses a patch window.