Grafana Tempo S3 SSE-C Encryption Key Exposure Vulnerability
Vulnerability
A vulnerability in Grafana Tempo allows the S3 SSE-C encryption key to be exposed in plaintext through the /status/config endpoint. This could enable unauthorized users to access the key used for encrypting trace data stored in S3.
Impact
Exposing the S3 SSE-C encryption key in plaintext could allow unauthorized users to decrypt trace data stored in S3, potentially leading to unauthorized access to sensitive information.
Remediation
Users can upgrade to Grafana Tempo version 2.10.3 or later to address this vulnerability.
Added: Mar 26, 2026, 10:38 PM
Updated: Mar 26, 2026, 10:38 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
7.4remediation
0.0relevance
4.7threat
0.0urgency
2.9incentive
4.2Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.