CVE-2026-28377: Grafana Tempo has Inadequate Encryption Strength

March 27, 2026 (updated July 21, 2026)

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.

References

github.com/advisories/GHSA-ffqx-q65f-36jf
github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/CHANGELOG.md?plain=1
github.com/grafana/tempo/commit/bb8ca663db34a0980c9758b40d918fda3b4dbec3
grafana.com/security/security-advisories/cve-2026-28377
nvd.nist.gov/vuln/detail/CVE-2026-28377

Code Behaviors & Features

Detect and mitigate CVE-2026-28377 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →