Grafana Alloy on Windows Unquoted service path
Priority LOW 36CWE-428Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-428.
Summary
Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Fix Fixed Alloy (Grafana): 1.3.3github.com/grafana/alloy (Go): 1.3.4, 1.4.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grafana | Alloy | before 1.3.3; 1.4.0-rc.0 – 1.4.0-rc.1 | 1.3.3 | Patch available | CNA |
| — | github.com/grafana/alloy (Go) | before 1.3.4 | 1.3.4 | Patch available | GHSA-chqx-36rm-rf8h |
| — | github.com/grafana/alloy (Go) | 1.4.0-rc.0 to before 1.4.1 | 1.4.1 | Patch available | GHSA-chqx-36rm-rf8h |
- Alloy VendorGrafana Affected before 1.3.3; 1.4.0-rc.0 – 1.4.0-rc.1 Fixed in 1.3.3 Patch available CNA
- github.com/grafana/alloy (Go) Vendor— Affected before 1.3.4 Fixed in 1.3.4 Patch available GHSA-chqx-36rm-rf8h
- github.com/grafana/alloy (Go) Vendor— Affected 1.4.0-rc.0 to before 1.4.1 Fixed in 1.4.1 Patch available GHSA-chqx-36rm-rf8h
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:grafana:alloy:*:*:*:*:*:*:*:* | before 1.3.3 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:alloy:1.4.0:rc0:*:*:*:*:*:* | 1.4.0 rc0 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:alloy:1.4.0:rc1:*:*:*:*:*:* | 1.4.0 rc1 | Vulnerable | Grafana |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:grafana:alloy:*:*:*:*:*:*:*:* Versions before 1.3.3 Vulnerable ·Grafana
- cpe:2.3:a:grafana:alloy:1.4.0:rc0:*:*:*:*:*:* Versions 1.4.0 rc0 Vulnerable ·Grafana
- cpe:2.3:a:grafana:alloy:1.4.0:rc1:*:*:*:*:*:* Versions 1.4.0 rc1 Vulnerable ·Grafana
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Alloy (Grafana) Fixed in 1.3.3
- Fix · GHSA-chqx-36rm-rf8h github.com/grafana/alloy (Go) Fixed in 1.3.4 Advisory →
- Fix · GHSA-chqx-36rm-rf8h github.com/grafana/alloy (Go) Fixed in 1.4.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8975
- 2026-10-03 Alias added: GHSA-chqx-36rm-rf8h
References
Advisory 3
Other 9
- https://github.com/grafana/alloy/releases/tag/v1.4.1
- https://github.com/grafana/alloy/releases/tag/v1.3.4
- https://github.com/grafana/alloy/commit/88e779887690954c009503598a3f4bf563cb6596
- https://github.com/grafana/alloy/commit/f14249012fd970d3fd73604e6fff9b6c7990a9bb
- https://github.com/grafana/alloy
- https://github.com/grafana/alloy/releases/tag/v1.4.0
- https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996
- https://grafana.com/security/security-advisories/cve-2024-8975
- https://pkg.go.dev/vuln/GO-2024-3168
Sources
- CVE-2024-8975 · CVE Program
- CVE-2024-8975 · NVD
- FIRST EPSS
- GHSA-chqx-36rm-rf8h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences