Executive brief
Grafana Tempo, a high-volume distributed tracing backend, contains a security flaw where sensitive encryption keys are exposed in plain text. An attacker could access these keys through a specific configuration endpoint, potentially allowing them to decrypt and read private trace data stored in Amazon S3. This could lead to the exposure of sensitive operational data or customer information contained within system traces.
Technical details
A vulnerability classified as Inadequate Encryption Strength (CWE-326) exists in Grafana Tempo's S3 storage backend. The application fails to redact the Customer-Provided Encryption Key (SSE-C) when displaying the system configuration via the /status/config endpoint. A remote, unauthenticated attacker with network access to this endpoint can retrieve the plaintext key used to encrypt trace data stored in S3. This allows for the potential decryption of all stored traces if the attacker also has access to the S3 buckets. The issue is resolved in version 2.10.3 by treating the encryption_key as a secret and redacting it from YAML output.
Affected products
- Grafana Tempo < 2.10.3
Timeline
- 2026-03-16: advisory: Initial advisory published by Grafana Labs
- 2026-03-26: disclosed: NVD publication date
- 2026-03-27: advisory: GitHub Advisory Database publication
- 2026-03-27: patched: Fix released in version 2.10.3