This vulnerability in Grafana Tempo (version 2.10.3) involves the exposure of the S3 SSE-C encryption key in plaintext through the /status/config endpoint. This key is used to encrypt trace data stored in S3, and its exposure could lead to unauthorized access to encrypted trace data. The vulnerability is classified under CWE-326 (inadequate encryption strength or key exposure). The CVSS 3.1 score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only. The product is a cloud service, and the vendor manages remediation. No known exploits are reported in the wild.

The exposure of the S3 SSE-C encryption key compromises the confidentiality of trace data stored in S3 by potentially allowing unauthorized users to decrypt this data. There is no reported impact on integrity or availability. This could lead to sensitive trace information disclosure.

A patch is available for this vulnerability. Since Grafana Tempo is offered as a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance has been updated. No additional user action is required if the service is managed by the vendor.