The vulnerability in Grafana Tempo 2.10.3 allows unauthorized access to the S3 SSE-C encryption key by exposing it in plaintext through the /status/config endpoint. This flaw relates to improper cryptographic key management (CWE-326) and could compromise the confidentiality of trace data encrypted and stored in S3. The CVSS 3.1 score of 7.5 reflects a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality but not integrity or availability. The service is cloud-hosted, and the vendor has released a patch to address this issue.

An attacker who accesses the /status/config endpoint can obtain the S3 SSE-C encryption key in plaintext, potentially allowing them to decrypt sensitive trace data stored in S3. This compromises the confidentiality of the encrypted data but does not affect data integrity or availability. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Since Grafana Tempo is a cloud service, the vendor manages remediation server-side. Users should verify that their service is updated to the patched version or confirm with Grafana that the fix has been applied. No additional user action is required beyond ensuring the patch is in place.