CLEANSTART-2026-CZ18029 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

Security vulnerability affects the tempo package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption...

CLEANSTART-2026-NL77468 Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy

Security vulnerability affects the grafana-fips package. Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

CLEANSTART-2026-IH60054 vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace ...

Security vulnerability affects the grafana-fips package. A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3...

CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: commercial-spilo-fips, aws-flb-kinesis-fips, crossplane-provider-aws-athena, clickhouse-operator-fips, grafana-operator, gcp-compute-persistent-disk-csi-driver-fips, harbor, crossplane-provider-aws-athena-fips, crossplane-provider-aws-lexmodels-fips, krakend-fips,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: commercial-spilo-fips, aws-flb-kinesis-fips, crossplane-provider-aws-athena, clickhouse-operator-fips, grafana-operator, gcp-compute-persistent-disk-csi-driver-fips, harbor, crossplane-provider-aws-athena-fips, crossplane-provider-aws-lexmodels-fips, krakend-fips,...

GO-2026-6611 vulnerabilities

Vulnerabilities for packages: commercial-spilo-fips, aws-flb-kinesis-fips, crossplane-provider-aws-athena, clickhouse-operator-fips, grafana-operator, gcp-compute-persistent-disk-csi-driver-fips, harbor, crossplane-provider-aws-athena-fips, crossplane-provider-aws-lexmodels-fips, krakend-fips,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: commercial-spilo-fips, aws-flb-kinesis-fips, crossplane-provider-aws-athena, clickhouse-operator-fips, grafana-operator, gcp-compute-persistent-disk-csi-driver-fips, harbor, crossplane-provider-aws-athena-fips, crossplane-provider-aws-lexmodels-fips, krakend-fips,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: commercial-spilo-fips, crossplane-provider-aws-athena, clickhouse-operator-fips, grafana-operator, gcp-compute-persistent-disk-csi-driver-fips, harbor, crossplane-provider-aws-athena-fips, crossplane-provider-aws-lexmodels-fips, krakend-fips, longhorn-share-manager,...

Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.2 release

Red Hat OpenShift distributed tracing platform Tempo 3.11.2 has been released This release of the Red Hat OpenShift distributed tracing platform Tempo provides security improvements. Breaking changes: None Deprecations: None Technology Preview features: None Enhancements: None Bug fixes: None Kno...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788279341)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788279341 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

CLEANSTART-2026-HJ64426 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the tempo package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-AP36720 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the tempo package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CLEANSTART-2026-BY71452 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the tempo package. gRPC-Go is the Go language implementation of gRPC...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

EUVD-2026-84806

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied accesslist from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume...

CVE-2026-63627 mppx: Gas Draining with padding

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas...

CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

EEF-CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

Summary Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying ...