Is CVE-2026-28377 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28377 being exploited in the wild.

How severe is CVE-2026-28377?

High severity, with a CVSS score of 7.5, published 27 March 2026.

Which products and versions are affected?

github.com/grafana/tempo (Go) < 2.10.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.10.3.

Is there a fix for CVE-2026-28377?

Yes. github.com/grafana/tempo (Go): upgrade to 2.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28377 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28377?

Check whether you run github.com/grafana/tempo (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28377: Grafana Tempo plaintext S3 encryption key exposure in config endpoint

Q: Is there a fix for CVE-2026-28377?

Yes. github.com/grafana/tempo (Go): upgrade to 2.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-28377 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-28377?

Check whether you run github.com/grafana/tempo (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28377 · Severity: high · CVSS 7.5 · Published 2026-03-27

Grafana Tempo, a high-volume distributed tracing backend, contains a security flaw where sensitive encryption keys are exposed in plain text. An attacker could access these keys through a specific configuration endpoint, potentially allowing them to decrypt and read private trace data stored in Amazon S3. This could lead to the exposure of sensitive operational data or customer information contained within system traces.

Technologies: github.com/grafana/tempo (Go). Vendors: Go.

Quick answers

Is CVE-2026-28377 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28377 being exploited in the wild.
How severe is CVE-2026-28377?: High severity, with a CVSS score of 7.5, published 27 March 2026.
Which products and versions are affected?: github.com/grafana/tempo (Go) < 2.10.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.10.3.
Is there a fix for CVE-2026-28377?: Yes. github.com/grafana/tempo (Go): upgrade to 2.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28377 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28377?: Check whether you run github.com/grafana/tempo (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/grafana/tempo (Go): upgrade to 2.10.3 or later
```
go get github.com/grafana/tempo@v2.10.3
```

Technical details

A vulnerability classified as Inadequate Encryption Strength (CWE-326) exists in Grafana Tempo's S3 storage backend. The application fails to redact the Customer-Provided Encryption Key (SSE-C) when displaying the system configuration via the /status/config endpoint. A remote, unauthenticated attacker with network access to this endpoint can retrieve the plaintext key used to encrypt trace data stored in S3. This allows for the potential decryption of all stored traces if the attacker also has access to the S3 buckets. The issue is resolved in version 2.10.3 by treating the encryption_key as a secret and redacting it from YAML output.

Affected products

Grafana Tempo < 2.10.3

Identifiers

CVE-2026-28377
GHSA-ffqx-q65f-36jf
GO-2026-5359

Timeline

2026-03-16: advisory: Initial advisory published by Grafana Labs
2026-03-26: disclosed: NVD publication date
2026-03-27: advisory: GitHub Advisory Database publication
2026-03-27: patched: Fix released in version 2.10.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.