CVE-2026-28377: 
Grafana vulnerability analysis and mitigation

CVE-2026-28377 is an information disclosure vulnerability in Grafana Tempo that exposes the S3 SSE-C (Server-Side Encryption with Customer-Provided Keys) encryption key in plaintext through the unauthenticated /status/config endpoint. It affects all Grafana Tempo versions prior to 2.10.3. The vulnerability was reported by researcher william_goodfellow and published on March 26, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Grafana Advisory).

The root cause is classified as CWE-326 (Inadequate Encryption Strength / improper key protection), where Grafana Tempo's /status/config endpoint returns the full runtime configuration — including the S3 SSE-C encryption key — in plaintext without requiring authentication. The attack vector is network-based, requires no privileges or user interaction, and has low attack complexity, making it trivially exploitable by any party with network access to the endpoint. No authentication or special preconditions beyond network reachability are required to retrieve the sensitive key material (Grafana Advisory).

An attacker who retrieves the exposed SSE-C key can use it to decrypt all trace data stored in the associated S3 bucket, resulting in a complete compromise of data confidentiality for observability/tracing data. There is no integrity or availability impact, but the exposure of encryption key material effectively nullifies the protection offered by S3 SSE-C encryption. Organizations storing sensitive distributed tracing data (which may include request parameters, headers, or internal service metadata) are at risk of full data exposure (Grafana Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploitation probability, the trivial nature of the attack (a simple unauthenticated HTTP GET request) means the barrier to exploitation is extremely low for any attacker with network access (Grafana Advisory).

1. Reconnaissance: Identify Grafana Tempo instances exposed on the network using port scanning tools (e.g., Shodan, Censys, or nmap) targeting the default Tempo HTTP port (typically 3200).
2. Verify version: Confirm the target is running a Grafana Tempo version prior to 2.10.3 by checking version indicators in HTTP responses or service banners.
3. Request the config endpoint: Send an unauthenticated HTTP GET request to the /status/config endpoint: curl http://<tempo-host>:<port>/status/config
4. Extract the SSE-C key: Parse the plaintext JSON/YAML response to locate the S3 SSE-C encryption key field within the storage configuration block.
5. Decrypt S3 data: Use the retrieved SSE-C key with the AWS CLI or SDK to access and decrypt trace data stored in the target S3 bucket: aws s3 cp s3://<bucket>/<object> . --sse-c AES256 --sse-c-key <extracted-key> (Grafana Advisory).

• Network: Unexpected or anomalous HTTP GET requests to /status/config on the Grafana Tempo HTTP port (default 3200) from external or untrusted IP addresses; repeated polling of this endpoint from a single source.
• Logs: Grafana Tempo access logs showing requests to /status/config from IPs outside of known administrative ranges; absence of authentication headers on such requests.
• S3 Access Logs: Unusual S3 GetObject requests using SSE-C headers from IP addresses not associated with the Tempo service or known administrators, potentially indicating use of the exposed key to decrypt stored objects.

Upgrade Grafana Tempo to version 2.10.3 or later, which contains the fix for this vulnerability (Grafana Advisory). As an interim workaround, restrict network access to the /status/config endpoint via firewall rules, network segmentation, or a reverse proxy that enforces authentication. After patching, rotate the S3 SSE-C encryption key to invalidate any previously exposed key material, and review S3 bucket access logs for signs of unauthorized decryption activity.

The vulnerability received standard coverage across vulnerability tracking platforms including NVD, ENISA EUVD (EUVD-2026-16424), and VulDB shortly after disclosure. OpenSUSE issued a security update announcement for affected packages. Social media activity was limited to automated CVE notification accounts. No significant researcher commentary or vendor statements beyond the official Grafana advisory have been identified.