alloy v1.20.1-tpio.1 openvex
Critical0
High0
Medium65
Low7
publish scan at 2026-10-15T16:38:48Z. Digest: sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2.
Predicates verified from the signed registry attestations.
Predicate type: https://openvex.dev/ns. SHA-256 of original predicate (compact JSON plus newline): 0d7ee1640033226e88b6ce712e23cd096424c57290066adc06b2e3681f2abb9a.
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://openvex.dev/ns oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2 | jq -r '.payload' | base64 -d | jq -c '.predicate' | sha256sum| CVE-2026-21726 | oci.thepeoples.io/hardened/alloy:v1.20.1-tpio.1, pkg:golang/github.com/grafana/loki/v3@v3.0.0-20260915071729-5cf8c23a258d | not_affected | vulnerable_code_not_present; The vendor advisory concerns path traversal in the Loki Ruler rules API. This exact Alloy parent contains 20 Loki log-processing, syntax, statistics, cache, utility and generated queryrange definition packages; no pkg/ruler package is in its complete compiled dependency graph. This is code absence, not a claim that the pseudo-version is patched. Alloy source revision 95e12cf8961fabc9db6858f7e79bde5c814a07a0; parent binary SHA256 8aa090b18e1ec2a0cf51b9b3b650008cd54308799c302b9d7e3b23925428dc62; compiled package graph SHA256 959929ec554e1189bc60dbe43e69c0b30a2345c42e3aaca5f49b644943244a11 in source records/packages.txt. Exact module version v3.0.0-20260915071729-5cf8c23a258d. Reference: https://grafana.com/security/security-advisories/cve-2026-21726/. | 2026-10-13T10:30:00Z |