A flaw in Grafana Tempo allows the S3 server‑side encryption (SSE‑C) key to be returned in clear text when a user accesses the /status/config endpoint. The revealed key can be used to decrypt trace data that is stored in an Amazon S3 bucket, thereby leaking the content of those traces. This weakness is a classic example of clear‑text credential storage (CWE‑312) coupled with the use of weak encryption (CWE‑326). The potential consequence is the compromise of all sensitive tracing information that the application collects.

The only product listed by the advisory is Grafana Tempo. No specific release numbers are provided, so any instance of Tempo could be at risk until a vendor patch is applied. Administrators should assume all deployed Tempo versions are vulnerable unless they verify that a fixed revision has already been installed.

The CVSS score of 7.5 indicates high impact. The EPSS score shows less than 1% likelihood of exploitation, and the issue is not listed in CISA's KEV catalog. The advisory does not explicitly state whether authentication is required for the /status/config endpoint; it is inferred that the endpoint is accessible to any user who can reach the Tempo service, implying that unauthorized access could obtain the key. With the key exposed, an attacker could decrypt all S3 trace data that was protected by SSE‑C, providing full confidentiality compromise for that data.