CLEANSTART-2026-TJ33106: vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace ...

Q: What access does an attacker need to exploit this issue?

The vulnerability is rated as network-accessible with low attack complexity. It does not require privileges or user interaction.

Q: Which deployments are most exposed?

Deployments of Grafana Tempo that use S3 SSE-C encryption for trace data are affected if an unauthorized party can access the /status/config endpoint. The issue concerns disclosure of the SSE-C key used for the S3-stored trace data.

Published Nov 3, 2026

Updated

Security vulnerability affects the grafana package. A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.

Affected Software

1 affected componentFixes available

cleanstart/grafana<13.1.9-r0

13.1.9-r0

Event History

Nov 3, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-28377

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is rated as network-accessible with low attack complexity. It does not require privileges or user interaction.

Which deployments are most exposed?

Deployments of Grafana Tempo that use S3 SSE-C encryption for trace data are affected if an unauthorized party can access the /status/config endpoint. The issue concerns disclosure of the SSE-C key used for the S3-stored trace data.

CLEANSTART-2026-TJ33106: vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace ...

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are most exposed?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are most exposed?