This vulnerability causes the SSE‑C encryption key used for securing trace data stored in Amazon S3 to be returned in cleartext when a user queries the /status/config endpoint of Grafana Tempo. Exposure of the key would allow anyone who can reach that endpoint to decrypt all the trace data that is encrypted with SSE‑C, compromising confidentiality and potentially revealing sensitive infrastructure or user information. The flaw arises because the key is not protected or authenticated before it is sent back to the requester.

Grafana Tempo is affected. No specific version numbers have been published in the advisory; administrators should verify whether their Tempo instance is running a version that implements SSE‑C and consult the vendor for patch availability.

The CVSS score of 7.5 indicates a high risk level, and the lack of authentication on the /status/config endpoint means an attacker with network access to the Tempo service can retrieve the key without needing valid credentials. Because EPSS is not available and the vulnerability is not listed in KEV, the quantitive probability remains unknown, but the attack surface is clear and straightforward. Rapid exploitation could occur if the service is exposed to the internet or an internal network with insufficient controls. This combination of high impact and easy exploitation elevates the urgency for remediation.