StackRadar

CVE-2026-28377

High

Advisory

Published 27 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.002
5th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
84
of 17,781 indexed, latest versions
Container images
51
deployed by those charts
Fix available
1 of 1
affected package

Grafana Tempo has Inadequate Encryption Strength

Carried by container images the latest versions of 84 of 17,781 indexed charts deploy, on 51 images.

Affected packageAffected versionsFixed inImages
github.com/grafana/tempogolangv0.0.0-20250806200423-6b92615861c3, v0.0.0-20251008140505-607c7fb69662, v0.0.0-20260413105002-54b109f75993, v0.0.0-20260813170847-f0f3ed59197b+10 more2.10.351
OSV records
GHSA-ffqx-q65f-36jfGO-2026-5359

Charts affected

84 by stars
ChartLatestAffected imagesRadar Score
kube-prometheus-stackprometheus-communityOfficialVerified publisher90.2.01 of 6See more

kube-prometheus-stack prometheus-community 90.2.0

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

740
grafanagrafana-communityVerified publisher13.2.41 of 1See more

grafana grafana-community 13.2.4

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

431
victoria-metrics-k8s-stackvictoriametricsVerified publisher0.92.11 of 7See more

victoria-metrics-k8s-stack victoriametrics 0.92.1

1 of the 7 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

1,889
tempografana-communityVerified publisher3.0.01 of 1See more

tempo grafana-community 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/tempo:3.0.30296560ac66f
github.com/grafana/tempo@v0.0.0-20260813195312-1900ed7bb5ca
2.10.3

Open the chart page →

148
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

9,864
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.1.4886b56d5534e
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

16,251
kube-prometheus-stackkube-prometheus-stack-oci91.2.11 of 6See more

kube-prometheus-stack kube-prometheus-stack-oci 91.2.1

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

647
pmmpercona1.9.11 of 1See more

pmm percona 1.9.1

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
percona/pmm-server:3.9.1003f9c25f842
github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b
2.10.3

Open the chart page →

790
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

3,795
coder-observabilitycoder-observabilityVerified publisher0.7.31 of 21See more

coder-observability coder-observability 0.7.3

1 of the 21 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:10.4.19a9043254ba16
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

24,700
finops-stackcert-managerVerified publisher0.0.51 of 12See more

finops-stack cert-manager 0.0.5

1 of the 12 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.1.3b23b588cf7cb
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

12,562
grafanacloudposse0.2.61 of 1See more

grafana cloudposse 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

720
dbrepodbrepo1.13.31 of 25See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.10.3

Open the chart page →

52,635
elchi-stackelchi1.13.01 of 10See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.2.074144189b384
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

15,383
temporalglasskubeVerified publisher0.45.2-gk.11 of 14See more

temporal glasskube 0.45.2-gk.1

1 of the 14 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.0.00dc5a246ab16
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

16,346
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.322 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

2 of the 17 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3
grafana/tempo:2.9.065a578975943
github.com/grafana/tempo@v0.0.0-20251008140505-607c7fb69662
2.10.3

Open the chart page →

15,418
lgtmlgtmVerified publisher0.24.02 of 9See more

lgtm lgtm 0.24.0

2 of the 9 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.2.0-distroless08e6ab6d67a5
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3
grafana/tempo:2.10.8f0561deb1c68
github.com/grafana/tempo@v0.0.0-20260813170847-f0f3ed59197b
2.10.3

Open the chart page →

1,008
lgtm-stacklgtm-stackVerified publisher0.1.32 of 8See more

lgtm-stack lgtm-stack 0.1.3

2 of the 8 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3
grafana/tempo:2.10.8f0561deb1c68
github.com/grafana/tempo@v0.0.0-20260813170847-f0f3ed59197b
2.10.3

Open the chart page →

5,576
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

22,420
smallest-self-hostsmallest-self-hostVerified publisher0.2.21 of 12See more

smallest-self-host smallest-self-host 0.2.2

1 of the 12 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.0.00dc5a246ab16
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

7,685
monitoringantmediaVerified publisher1.0.01 of 6See more

monitoring antmedia 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

2,453
grafanabook-k8sinfra-v28.8.21 of 1See more

grafana book-k8sinfra-v2 8.8.2

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.4.0d8ea37798ccc
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.10.3

Open the chart page →

1,800
kube-prometheus-stackbook-k8sinfra-v265.5.11 of 6See more

kube-prometheus-stack book-k8sinfra-v2 65.5.1

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.2.2-security-01464eac539793
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.10.3

Open the chart page →

6,036
tempobook-k8sinfra-v21.10.31 of 1See more

tempo book-k8sinfra-v2 1.10.3

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/tempo:2.5.0f0200a9bff6d
github.com/grafana/tempo@v2.5.0
2.10.3

Open the chart page →

1,859
temporalcastaiVerified publisher0.54.21 of 14See more

temporal castai 0.54.2

1 of the 14 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.0.00dc5a246ab16
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

16,198
catalyst-agentscatalyst-agents0.1.302 of 18See more

catalyst-agents catalyst-agents 0.1.30

2 of the 18 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.1.3ab5cb380e3ff
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3
grafana/tempo:2.5.0f0200a9bff6d
github.com/grafana/tempo@v2.5.0
2.10.3

Open the chart page →

15,027
kube-ceemsceemsOfficialVerified publisher1.40.01 of 5See more

kube-ceems ceems 1.40.0

1 of the 5 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

640
monitoringcluster-deploy0.3.01 of 11See more

monitoring cluster-deploy 0.3.0

1 of the 11 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

8,183
loki-stackcommon-chartsVerified publisher1.0.31 of 12See more

loki-stack common-charts 1.0.3

1 of the 12 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

5,329
dapr-agentsdapr-agents-devVerified publisher0.1.52 of 31See more

dapr-agents dapr-agents-dev 0.1.5

2 of the 31 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3
grafana/tempo:2.9.065a578975943
github.com/grafana/tempo@v0.0.0-20251008140505-607c7fb69662
2.10.3

Open the chart page →

22,193
monitoring-stackdata354-helmVerified publisher1.4.21 of 4See more

monitoring-stack data354-helm 1.4.2

1 of the 4 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

3,176
defactopsdefactops1.0.91 of 2See more

defactops defactops 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
defactops/defactops-ui:1.0.16825cdf9ba706
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

4,509
dnation-kubernetes-monitoring-stackdnationcloud4.0.21 of 17See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

1 of the 17 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

21,641
eoapi-supporteoapiVerified publisher0.1.71 of 7See more

eoapi-support eoapi 0.1.7

1 of the 7 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:10.3.38640e5038e83
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

8,648
upgrade-responderepinioVerified publisher0.2.01 of 5See more

upgrade-responder epinio 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:10.1.50679e877ba20
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

7,329
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.22 of 18See more

farm-observability farm-observability 0.27.2

2 of the 18 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.0.1-security-012d1f9ae67c17
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3
grafana/tempo:2.9.065a578975943
github.com/grafana/tempo@v0.0.0-20251008140505-607c7fb69662
2.10.3

Open the chart page →

13,255
monitoringgaloymoney0.12.211 of 6See more

monitoring galoymoney 0.12.21

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.10.3

Open the chart page →

5,295
monitoringgaloymoney20.12.211 of 6See more

monitoring galoymoney2 0.12.21

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.10.3

Open the chart page →

5,295
gnp-stackgnp-stack0.0.51 of 14See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.2.135c41e0fd029
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

7,659
kube-prometheus-stackgpg-dev84.0.01 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.0.10f86bada30d6
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

4,288
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.3.1fa801ab6e1ae
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.10.3

Open the chart page →

49,025
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/grafana/tempo@v0.0.0-20250806200423-6b92615861c3
2.10.3

Open the chart page →

8,188
routergroundcover1.12.3571 of 7See more

router groundcover 1.12.357

1 of the 7 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.54-grafana11.3.7ee9d973e3952
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.10.3

Open the chart page →

6,009
logging-stackhelm-charts-alexis-carbillet0.1.01 of 9See more

logging-stack helm-charts-alexis-carbillet 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.1.0079600c9517b
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

12,650
monitoring-stackhelm-charts-alexis-carbillet0.1.02 of 11See more

monitoring-stack helm-charts-alexis-carbillet 0.1.0

2 of the 11 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.10.3
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

9,460
grafanakubeblocksVerified publisher6.59.41 of 1See more

grafana kubeblocks 6.59.4

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:10.1.11b9ca4bbc4a2
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

3,561
tempo-distributedloafoe1.20.11 of 2See more

tempo-distributed loafoe 1.20.1

1 of the 2 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/tempo:2.6.0f55a8a1937ff
github.com/grafana/tempo@v2.6.0
2.10.3

Open the chart page →

2,020
locust-pluginslocust-pluginsVerified publisher0.0.41 of 3See more

locust-plugins locust-plugins 0.0.4

1 of the 3 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
sky5367/locust-plugins-grafana:latestd51bf68d4b26
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

7,510
kube-prometheus-stackmesosphere87.16.01 of 7See more

kube-prometheus-stack mesosphere 87.16.0

1 of the 7 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

7,398
prometheus-operatormesosphere12.11.131 of 8See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

11,689

Container images carrying it

51 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/opstree/tempo:2.10.4-debian13cb734024b3fd
github.com/grafana/tempo@v0.0.0-20260413105002-54b109f75993
2.10.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.