Grafana CVE-2026-28377

Grafana Tempo with S3 SSE-C encryption configured. Remote unauthenticated attacker accessing the /status/config endpoint. No victim interaction required. Default Tempo installations without S3 SSE-C configuration are NOT affected.

Real-world risk is significant despite no active exploitation evidence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates the vulnerability is remotely exploitable without authentication and with low attack complexity, achieving high confidentiality impact. The attack is highly automatable as it requires only HTTP requests to a known endpoint, making it suitable for mass scanning. EPSS probability data is not available in current intelligence, and KEV status indicates no confirmed active exploitation. However, the technical impact is severe: compromised SSE-C keys enable attackers to decrypt historical trace data in S3, potentially exposing sensitive application telemetry, API tokens, or user information embedded in traces. The vulnerability is tagged with Authentication Bypass, suggesting the endpoint may bypass intended access controls. Priority should be elevated for organizations storing sensitive data in Tempo traces, particularly those subject to compliance requirements. The straightforward exploitation path and lack of required privileges make this a realistic target once public details emerge, even without confirmed exploitation at present.

An unauthenticated remote attacker sends an HTTP GET request to the publicly accessible /status/config endpoint on a Grafana Tempo instance. The server responds with configuration details including the S3 SSE-C encryption key in plaintext. Using the obtained key, the attacker authenticates to AWS S3 (if bucket permissions allow or through compromised AWS credentials obtained separately) and decrypts stored trace data, extracting sensitive application telemetry, authentication tokens, or personally identifiable information embedded in distributed traces. No public exploit identified at time of analysis, though the attack requires only basic HTTP client capabilities.