CVE-2026-28377: grafana tempo Inadequate Encryption Strength
CVSS: 7.5v3.1HighAnalyzed
AliasesCGA-4hcw-3xrj-4m2jCGA-7gr3-mjqj-922pCGA-9ph2-2gvc-7ww5CGA-cwg6-h3gv-48hfCGA-j4h8-6mqj-pq7wCGA-jrmp-7m48-mmwjGHSA-ffqx-q65f-36jfGO-2026-5359openSUSE-SU-2026:10390-1CGA-2jg9-f4vf-r43qCGA-2prr-3wwc-fg9qCGA-2q4m-rm22-6hvqCGA-32jq-vvpj-99vjCGA-344v-xf82-658xCGA-39f7-vjc4-w923CGA-3g7m-wfwx-xhjwCGA-42vc-w835-3v3mCGA-48j9-qxch-rfv4CGA-499j-6q2g-2jm7CGA-57q7-2h3x-wvgrCGA-5h53-83fw-vjxfCGA-5pgv-9rwf-8mr6CGA-5qqr-r39g-mg36CGA-5v7h-mx3w-wfqwCGA-64h3-5q6r-2rvqCGA-684p-c77h-qgw6CGA-693g-3p92-7298CGA-6pxc-p63w-4hhqCGA-76hx-3xvp-9532CGA-76vm-49r7-5p9fCGA-7fmx-c3cq-xv3vCGA-7pp9-33j8-4mfcCGA-7qxm-q96h-rgr7CGA-8fm7-rqjj-5h6pCGA-953r-86wp-xw28CGA-cfj8-2999-h3hrCGA-fm8m-5vq9-9w65CGA-fphp-fpj3-vpmfCGA-g5x6-grp2-gf5rCGA-g94j-pw2m-95wrCGA-h945-8grp-h4rrCGA-hx3w-jmph-3x69CGA-j372-98hc-2qcmCGA-j4gm-jrxc-3jcxCGA-j93j-r54q-jggpCGA-jwx7-wwg5-5rrgCGA-mmxm-4mhq-vwmgCGA-mw3v-c2vg-45wrCGA-pj22-cf9v-qm8xCGA-ppj2-v3h8-xj9mCGA-rgw7-3fqm-hp2xCGA-v328-r536-232xCGA-v8g4-734q-rr5xCGA-vfjr-w4x3-qxmpCGA-vq6f-7pcx-h2qqCGA-wc3j-9grx-vf8mCGA-wjvp-rfmj-g5wxCGA-wmjm-fhj4-rwghCGA-wmp8-mg99-2rw2
Published 26-03-2026Last modified 27-08-2026
Vulnerability summary
CVE-2026-28377 is a high (CVSS 7.5) Inadequate Encryption Strength vulnerability in grafana tempo. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.16%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 26-03-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
+0.01 pp
From 0.15% on 20-09-2026
20-09-202620-10-2026
EPSS score0.16%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard28 products
- commercial-grafana-11.6All versions (No fix recorded)
- commercial-grafana-12.1All versions (No fix recorded)
- commercial-grafana-12.2All versions (No fix recorded)
- commercial-grafana-12.3All versions (No fix recorded)
- commercial-grafana-12.4All versions (No fix recorded)
Wolfi3 products
- grafana-12.3All versions (No fix recorded)
- grafana-12.4All versions (No fix recorded)
- grafana-13.0All versions (No fix recorded)
Github.com/grafana1 product
- tempo< 2.10.3 | All versions (No fix recorded)
Grafana1 product
- tempo2.10.3 | < 2.10.3
Opensuse1 product
- tempo-cli&distro=openSUSE Tumbleweed< 2.10.3-1.1
5 vendors · 34 products
References
8 links
- github.com/grafana/tempoPACKAGE