CVE-2026-28377
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.
Risk Assessment
The exposure of the encryption key may lead to unauthorized access to sensitive data, posing a serious security threat to the organization.
Recommendation
It is recommended to block access to the /status/config endpoint and review security configurations to prevent the exposure of the encryption key.
Other vulnerabilities in Grafana Tempo
Original NVD description (English source)
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.