← Back

CVE-2026-28377

nvd nist
Published: Mar 26, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: security@grafana.com (Secondary)

Description

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.

Affected (1)

Products: Grafana: Tempo
Grafana
1 product
Tempo
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Tempo
Before 2.10.3

Related CWEs

CWE-326
Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (1)

Source: security@grafana.com
Vendor Advisory

Timeline

No history available yet.