Grafana Alloy's bearerTokenFile Read Any Local File and Sent It as an Authorization Header

A telemetry agent that reads a token from a path you can name will read any path you can name. How CVE-2026-75889 turns an Alloy configuration into credential exfiltration, and the mount rules that stop it.