Security readout for executives and security teams
Plain-English summary
Grafana Tempo may reveal the secret used to encrypt S3 trace data through its configuration-status endpoint. An unauthenticated network user who can reach that endpoint could obtain the key, undermining trace-data confidentiality. The supplied record identifies Tempo 2.10.3, but does not establish whether other versions are affected.
Executive priority
Prioritize immediate assessment for internet-facing or broadly accessible Tempo 2.10.3 deployments using S3 SSE-C. Restrict the endpoint first, investigate possible access, and coordinate key handling carefully. The business concern is potential disclosure of trace data and sensitive operational information, not demonstrated data alteration or service disruption.
Technical view
The /status/config endpoint can expose an S3 SSE-C encryption key in plaintext. The supplied CVSS 3.1 score is 7.5, reflecting network access, low complexity, no privileges, no user interaction, and high confidentiality impact. The record assigns CWE-326, although the described failure is specifically plaintext secret disclosure.
Likely exposure
Highest risk applies to Tempo 2.10.3 deployments using S3 SSE-C where /status/config is reachable by untrusted users or networks. Deployments not using SSE-C, not running the identified version, or preventing unauthorized endpoint access are less likely to be exposed. The bundle marks other versions unaffected by default but provides incomplete version-range detail.
Exploitation context
The issue is remotely reachable and reportedly requires no authentication when the endpoint is exposed. The supplied sources do not report active exploitation, and CVE-2026-28377 is not listed as KEV in the bundle. No exploit maturity or observed attack activity is established.
Researcher notes
The supplied CVSS vector limits modeled impact to confidentiality. Evidence supports plaintext key exposure through /status/config, but the bundle does not name a fixed release, clarify authentication defaults, or provide complete affected-version boundaries. Validate those points against the current vendor advisory before closing or escalating findings.
Mitigation direction
- Check Grafana's advisory for supported fixed versions or vendor-approved remediation.
- Restrict /status/config to trusted administrative networks and authenticated access.
- Determine whether the SSE-C key was exposed before rotating or replacing it.
- Follow AWS and Grafana guidance to preserve access when changing SSE-C keys.
- Treat affected trace data and disclosed encryption material as potentially compromised.
Validation and detection
- Inventory Grafana Tempo versions and identify deployments running 2.10.3.
- Confirm whether each deployment uses S3 server-side encryption with customer-provided keys.
- Verify whether untrusted users or networks can reach /status/config.
- Review access logs for unexpected requests to the configuration endpoint.
- Confirm remediation without collecting, displaying, or retaining the encryption key.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-326: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28377 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6GRAFANAVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://grafana.com/security/security-advisories/cve-2026-28377CVE reference, GRAFANA · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inadequate Encryption Strength
Inadequate Encryption Strength represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.