Executive Summary

This vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint.

Because the encryption key is exposed, unauthorized users could potentially obtain the key used to encrypt trace data stored in S3.

Useful 0 Not Useful 0

Impact Analysis

The exposure of the S3 SSE-C encryption key can allow unauthorized users to access encrypted trace data stored in S3.

This compromises the confidentiality of sensitive trace data, potentially leading to data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes the S3 SSE-C encryption key in plaintext, potentially allowing unauthorized access to encrypted trace data stored in S3.

Such exposure of encryption keys can lead to unauthorized data access, which may result in non-compliance with data protection standards and regulations like GDPR and HIPAA that require protection of sensitive data.

Therefore, this vulnerability could negatively impact compliance by compromising the confidentiality of protected data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the /status/config endpoint of your Grafana Tempo instance exposes the S3 SSE-C encryption key in plaintext.

You can use commands like curl to query this endpoint and inspect the response for the presence of the encryption key.

• curl -s http://<tempo-server>/status/config | grep -i 'encryptionKey'

If the encryption key is visible in the response, your system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Grafana Tempo to version 2.10.3 or later, where this vulnerability has been fixed.

Until the upgrade is applied, restrict access to the /status/config endpoint to trusted users only to prevent unauthorized retrieval of the encryption key.

Useful 0 Not Useful 0