CVE-2026-28377highCWE-326

CVE-2026-28377: high-severity vulnerability in Grafana Tempo

S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)

Published · Updated

Follow this CVE+ Monitor Tempo+ Monitor github.com/grafana/tempo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.2%
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Grafana · Tempo
Related CVEs — Grafana Tempo

In the same product, most dangerous first.

CVE-2026-21728HIGHTempo query limit results in unbounded memory allocationEPSS 0.6%CVE-2026-27878MEDIUMTempo TraceQL query with exemplar hint could result in unbounded memory usageEPSS 0.4%