CVE-2026-28377High· 7.5▾ TwilightGrafana Tempo has Inadequate Encryption Strength
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.
Grafana thanks william_goodfellow for reporting this vulnerability.
github.com/grafana/tempo < 2.10.3Upgrade to a patched release:
github.com/grafana/tempo 2.10.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27878Medium· 6.5Grafana Tempo vulnerable to an out-of-memory crash
CVE-2023-22462Medium· 6.4Grafana vulnerable to Stored Cross-site Scripting in Text plugin
CVE-2020-13430Medium· 6.1Grafana XSS via the OpenTSDB datasource
CVE-2024-10452Low· 2.2Grafana org admin can delete pending invites in different org
CVE-2019-19499Medium· 6.5Grafana Arbitrary File Read
CVE-2025-3415Medium· 4.3Grafana's insecure DingDing Alert integration exposes sensitive information