Skip to content
fr Sign in
7.5 High

CVE-2026-28377 A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint,…

Description

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.

Affected products and versions

Product Affected versions Fixed in
Tempo 2.10.3 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Tempo

The 3 CVEs of Tempo →
CVE-2026-27878 A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive… 6.5 Medium CVE-2026-21728 Tempo queries with large limits can cause large memory allocations which can impact the availability of the service,… 7.5 High
Track this CVE