GHSA-ffqx-q65f-36jf

Suggest an improvement
Source
https://github.com/advisories/GHSA-ffqx-q65f-36jf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-ffqx-q65f-36jf/GHSA-ffqx-q65f-36jf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-ffqx-q65f-36jf
Aliases
  • CVE-2026-28377
Downstream
Published
2026-03-27T00:31:20Z
Modified
2026-05-09T20:14:19.931321416Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Grafana Tempo has Inadequate Encryption Strength
Details

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.

Grafana thanks william_goodfellow for reporting this vulnerability.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T04:07:51Z",
    "cwe_ids": [
        "CWE-326"
    ],
    "severity": "HIGH",
    "nvd_published_at": "2026-03-26T22:16:28Z"
}
References

Affected packages

Go / github.com/grafana/tempo

Package

Name
github.com/grafana/tempo
View open source insights on deps.dev
Purl
pkg:golang/github.com/grafana/tempo

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.10.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-ffqx-q65f-36jf/GHSA-ffqx-q65f-36jf.json"