What is the CVSS score of CVE-2026-28377?

CVE-2026-28377 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Grafana are affected by CVE-2026-28377?

Grafana Tempo instances expose AWS S3 encryption keys through an unauthenticated API endpoint, allowing attackers to bypass encryption protections on trace data stored in cloud infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-28377?

Within 24 hours: Audit all Grafana Tempo deployments and restrict network access to the /status/config endpoint using firewall or WAF rules to block external traffic. Within 7 days: Rotate all S3 SSE-C encryption keys used with affected Tempo instances; document current key exposure scope by reviewing access logs to the /status/config endpoint. Within 30 days: Implement network segmentation to isolate Tempo instances, disable the /status/config endpoint if not operationally required, and monitor vendor advisories for patched versions; consider migrating to S3 SSE-KMS with AWS KMS key management as an alternative encryption approach.

Grafana CVE-2026-28377

EUVD-2026-16424 HIGH

Inadequate Encryption Strength (CWE-326)

2026-03-26 GRAFANA

GHSA-ffqx-q65f-36jf

Grafana Authentication Bypass Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 22:01 euvd

EUVD-2026-16424

Analysis Generated

Mar 26, 2026 - 22:01 vuln.today

CVE Published

Mar 26, 2026 - 21:39 nvd

HIGH 7.5

DescriptionCVE.org

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.

Thanks to william_goodfellow for reporting this vulnerability.

AnalysisAI

Grafana Tempo leaks S3 SSE-C encryption keys in plaintext through its /status/config endpoint, enabling unauthenticated remote attackers to retrieve encryption keys protecting trace data stored in AWS S3. The CVSS score of 7.5 reflects high confidentiality impact with network-accessible attack vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, though the attack path is straightforward given the information disclosure nature of the vulnerability.

Technical ContextAI

Grafana Tempo is a distributed tracing backend designed to store and query trace data. The affected component is the /status/config endpoint, which exposes server-side encryption customer-provided keys (SSE-C) used for AWS S3 bucket encryption. SSE-C is an AWS S3 encryption method where customers manage their own encryption keys while AWS performs the encryption/decryption operations. The vulnerability stems from improper sanitization of sensitive configuration values before rendering them through the status endpoint. According to CPE data (cpe:2.3:a:grafana:tempo:*:*:*:*:*:*:*:*), all versions of Grafana Tempo are potentially affected unless otherwise specified in vendor advisories. The vulnerability represents an information disclosure issue where cryptographic material is exposed through an API endpoint, though no specific CWE classification was provided in available intelligence.

RemediationAI

Consult the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-28377 for official patch versions and upgrade guidance. Vendor-released patch details are not specified in current intelligence, so organizations should immediately review the advisory for fixed Tempo versions and upgrade accordingly. As an interim mitigation until patching is completed, restrict network access to the /status/config endpoint using firewall rules, web application firewalls, or reverse proxy configurations to permit access only from trusted administrative IP ranges. Consider implementing authentication requirements at the proxy layer for all administrative endpoints if not already enforced. Organizations should rotate their S3 SSE-C encryption keys immediately if the /status/config endpoint was publicly accessible, as historical exposure of these keys may have occurred. Review access logs for unauthorized requests to /status/config to assess potential compromise scope.