Tempo vulnerabilities

2 known vulnerabilities in Tempo from Grafana. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Tempo: Uncontrolled Resource Consumption

  CVE-2026-21728Apr 24, 2026Grafana

  Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternati

• 7.5 High severity

  Tempo: Inadequate Encryption Strength

  CVE-2026-28377Mar 26, 2026Grafana

  A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting