CVE catalog
CVE-2026-28377
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace d
- Severity
- High · CVSS 7.5
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.16% · Oct 25, 2026
A flaw was found in Grafana Tempo. This vulnerability exposes the S3 Server-Side Encryption with Customer-Provided Keys (SSE-C) encryption key in plaintext through the /status/config endpoint. A remote attacker could exploit this to obtain the key, potentially allowing unauthorized access and decryption of sensitive trace data stored in S3. Grafana Tempo: Grafana Tempo: Information disclosure of S3 encryption key via status config endpoint The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | tempo | Not reported | 2.10.3 | fixed |
| Opensuse | tempo-cli | tumbleweed | 2.10.3-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | tempo | cpe | Not reported | 2.10.3 | Not reported | Not reported | Not reported |
| Opensuse | tempo-cli | rpm | tumbleweed | 2.10.3-1.1 | Not reported | OPENSUSE-SU-2026:10390-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10390-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-28377]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10390-1]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28377.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0764.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]