Em resumo
- CVE-2026-28377 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta github.com/grafana/tempo, tempo (grafana).
- Chance de exploração nos próximos 30 dias (EPSS): 0.16%, maior que 5.3% das vulnerabilidades.
- Correção: atualize para 2.10.3 ou posterior.
Description
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.
NVD description
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.
Thanks to william_goodfellow for reporting this vulnerability.
Mais vulnerabilidades de github.com/grafana/tempo
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free