[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTftjG0FYQLd5kbOL2VGYyygT5AodgZbK-Z7Gn010dnE":3,"g5a-risk:CVE-2026-28377":105},{"success":4,"data":5,"meta":102},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":32,"epssPercentile":26,"epssTimeSeries":33,"severity":34,"affectedProducts":35,"affectedProductsCount":41,"references":42,"referencesCount":41,"weaknesses":48,"weaknessesCount":41,"isActivelyExploited":57,"cisaInfo":26,"otxData":26,"relatedBlogPosts":58,"seoMetadata":59,"configurations":84,"relatedVendorCves":93,"notableEvents":94},"CVE-2026-28377","What is CVE-2026-28377?","A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the \u002Fstatus\u002Fconfig endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.\n\nThanks to william_goodfellow for reporting this vulnerability.","A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the \u002Fstatus\u002Fconfig endpoint, potentially allowing unauthorized user...","2026-03-26T22:16:28.46","2026-06-17T13:20:14.76",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":29,"CVSSMetricV2":30,"CVSSMetricV40":31},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"security@grafana.com","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,[],[],[],0.00164,[32,32,32,32,32,32,32],"High",[36],{"vendor":37,"product":38,"version":39,"criteria":40,"vulnerable":4},"grafana","tempo","*","cpe:2.3:a:grafana:tempo:*:*:*:*:*:*:*:*",1,[43],{"url":44,"source":45,"tags":46},"https:\u002F\u002Fgrafana.com\u002Fsecurity\u002Fsecurity-advisories\u002Fcve-2026-28377","Grafana",[47],"Vendor Advisory",[49],{"id":50,"name":51,"description":52,"extendedDescription":53,"status":54,"abstraction":55,"structure":56},"CWE-326","Inadequate Encryption Strength","The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.","A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.","Draft","Class","Simple",false,[],{"title":60,"metaDescription":61,"keywords":62,"canonicalUrl":63,"structuredData":64},"What is CVE-2026-28377? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2026-28377, a high severity cyber security vulnerability from 2026. A vulnerability in Grafana Tempo exposes the S3 SSE-C encry...","CVE-2026-28377, CVE-2026-28377 vulnerability, CVE-2026-28377 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, grafana security, tempo vulnerability","\u002Fwhat-is\u002Fcve-2026-28377",{"@context":65,"@type":66,"headline":60,"description":61,"datePublished":10,"dateModified":11,"author":67,"publisher":71,"about":75,"mainEntityOfPage":79,"articleSection":82,"keywords":83},"https:\u002F\u002Fschema.org","TechArticle",{"@type":68,"name":69,"url":70},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":68,"name":69,"url":70,"logo":72},{"@type":73,"url":74},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":76,"name":6,"description":77,"additionalType":78},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":80,"@id":81},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2026-28377","Cybersecurity","CVE-2026-28377, CVE-2026-28377 vulnerability, CVE-2026-28377 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[85],{"Operator":26,"Negate":26,"Nodes":86},[87],{"Operator":88,"Negate":57,"CPEMatch":89},"OR",[90],{"Vulnerable":4,"Criteria":40,"MatchCriteriaID":91,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":92,"VersionEndIncluding":26},"B1FEA69C-8014-4D65-AFA0-5C44DF250663","2.10.3",[],[95],{"id":96,"eventType":97,"eventTime":98,"details":99,"label":100,"color":101},"ef5ab81b-344a-4f85-9713-f076899c2520","NEW_NVD","2026-04-01T11:41:06.648725+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":103,"version":104},1792262416708,"2.0",{"score":106,"band":107,"action":108,"scoredAt":109},46,"Medium","Plan remediation","2026-10-16T07:12:22.424578+00:00"]