CVE-2026-28377

Go/github.com/grafana/tempo CVE-2026-28377: high 7.5, EPSS 0.17%

Grafana Tempo has Inadequate Encryption Strength

Action: Upgrade github.com/grafana/tempo to 2.10.3 or later.

go get github.com/grafana/tempo@v2.10.3

Affected

Fixed versions

Sources

• osv: GHSA-ffqx-q65f-36jf
• https://nvd.nist.gov/vuln/detail/CVE-2026-28377
• https://github.com/grafana/tempo/commit/bb8ca663db34a0980c9758b40d918fda3b4dbec3
• https://github.com/advisories/GHSA-ffqx-q65f-36jf
• https://github.com/grafana/tempo
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/CHANGELOG.md?plain=1#L135
• https://grafana.com/security/security-advisories/cve-2026-28377

CVE-2026-28377 · published 2026-03-27T00:31:20Z · modified 2026-09-10T03:51:00.288444154Z · JSON

Go/github.com/grafana/tempo CVE-2026-28377: unknown, EPSS 0.17%

Grafana Tempo has Inadequate Encryption Strength in github.com/grafana/tempo

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5359
• https://github.com/advisories/GHSA-ffqx-q65f-36jf
• https://nvd.nist.gov/vuln/detail/CVE-2026-28377
• https://github.com/grafana/tempo/commit/bb8ca663db34a0980c9758b40d918fda3b4dbec3
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/CHANGELOG.md?plain=1#L135
• https://grafana.com/security/security-advisories/cve-2026-28377

CVE-2026-28377 · published 2026-06-25T18:43:19Z · modified 2026-07-09T12:44:26.870919557Z · JSON