What is GHSA-ffqx-q65f-36jf?

GHSA-ffqx-q65f-36jf is a security advisory published by GitHub Security Advisories with High severity. Grafana Tempo has Inadequate Encryption Strength

Which CVE IDs does GHSA-ffqx-q65f-36jf cover?

GHSA-ffqx-q65f-36jf covers the following CVE IDs: CVE-2026-28377. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ffqx-q65f-36jf?

GHSA-ffqx-q65f-36jf has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-ffqx-q65f-36jf?

GHSA-ffqx-q65f-36jf affects 1 product, including: go/github.com/grafana/tempo:\u003c 2.10.3.

GHSA-ffqx-q65f-36jfHighCVSS 7.5

Grafana Tempo has Inadequate Encryption Strength

Vendor

GitHub Security Advisories

Published

March 27, 2026

Last Modified

July 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-28377 →

📋 Description

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.

🎯 Affected products1

go/github.com/grafana/tempo:< 2.10.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-28377
https://grafana.com/security/security-advisories/cve-2026-28377
https://github.com/grafana/tempo/commit/bb8ca663db34a0980c9758b40d918fda3b4dbec3
https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/CHANGELOG.md?plain=1#L135
https://github.com/advisories/GHSA-ffqx-q65f-36jf