Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-28377 A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint,…

Description

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.

Produits et versions touchés

Produit Versions touchées Corrigé en
Tempo 2.10.3 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Tempo

Les 3 CVE de Tempo →
CVE-2026-27878 A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive… 6.5 Moyenne CVE-2026-21728 Tempo queries with large limits can cause large memory allocations which can impact the availability of the service,… 7.5 Élevée
Suivre cette CVE