CVE-2026-28377
Fixed in a distro release EPSS <1%CVSS 7.5
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.
Products: Grafana Tempo
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/tempo | 2.10.3 |
| Go | github.com/grafana/tempo | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-grafana-11.6 | no fix |
| Chainguard | commercial-grafana-12.1 | no fix |
| Chainguard | commercial-grafana-12.2 | no fix |
| Chainguard | commercial-grafana-12.3 | no fix |
| Chainguard | commercial-grafana-12.4 | no fix |
| Chainguard | commercial-grafana-13.0 | no fix |
| Chainguard | commercial-grafana-13.1 | no fix |
| Chainguard | commercial-grafana-13.2 | no fix |
| Chainguard | grafana-11.6 | no fix |
| Chainguard | grafana-12.0 | no fix |
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-12.2 | no fix |
| Chainguard | grafana-12.3 | no fix |
| Chainguard | grafana-12.4 | no fix |
| Chainguard | grafana-13.0 | no fix |
| Chainguard | grafana-13.1 | 0 |
| Chainguard | grafana-fips-11.6 | no fix |
| Chainguard | grafana-fips-12.0 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | no fix |
| Chainguard | grafana-fips-12.3 | no fix |
| Chainguard | grafana-fips-12.4 | no fix |
| Chainguard | grafana-fips-13.0 | no fix |
| Chainguard | grafana-fips-13.1 | 0 |
| Chainguard | grafana-geomys-fips-13.1 | 0 |
| Chainguard | grafana-tempo-datasource | 0 |
| Chainguard | grafana-tempo-datasource-fips | 0 |
| Chainguard | percona-grafana | 0 |
| Wolfi | grafana-12.3 | no fix |
| Wolfi | grafana-12.4 | no fix |
| Wolfi | grafana-13.0 | no fix |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Tumbleweed | tempo-cli | 2.10.3-1.1 |