StackRadar

CVE-2026-28377

High

Advisory

Published 27 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.002
5th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
84
of 17,781 indexed, latest versions
Container images
51
deployed by those charts
Fix available
1 of 1
affected package

Grafana Tempo has Inadequate Encryption Strength

Carried by container images the latest versions of 84 of 17,781 indexed charts deploy, on 51 images.

Affected packageAffected versionsFixed inImages
github.com/grafana/tempogolangv0.0.0-20250806200423-6b92615861c3, v0.0.0-20251008140505-607c7fb69662, v0.0.0-20260413105002-54b109f75993, v0.0.0-20260813170847-f0f3ed59197b+10 more2.10.351
OSV records
GHSA-ffqx-q65f-36jfGO-2026-5359

Charts affected

84 by stars
ChartLatestAffected imagesRadar Score
kube-prometheus-stackmesosphere-stable75.9.11 of 7See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.0.2b5b59bfc7561
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.10.3

Open the chart page →

10,180
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:10.4.0f9811e4e687f
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

7,309
grafana-chartmy-personal-grafana0.1.01 of 1See more

grafana-chart my-personal-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

720
jupyterhub-metricsncsaVerified publisher1.3.01 of 5See more

jupyterhub-metrics ncsa 1.3.0

1 of the 5 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

4,132
grafananodepulse7.1.01 of 1See more

grafana nodepulse 7.1.0

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:10.2.36b5b37eb35bb
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

2,966
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.1.1a1701c218024
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

17,070
pgaot-container-kit1.0.31 of 6See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.1.0079600c9517b
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

5,137
tempo-standaloneot-container-kit1.0.11 of 1See more

tempo-standalone ot-container-kit 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
quay.io/opstree/tempo:2.10.4-debian13cb734024b3fd
github.com/grafana/tempo@v0.0.0-20260413105002-54b109f75993
2.10.3

Open the chart page →

588
vmot-container-kit0.0.31 of 7See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.1.4886b56d5534e
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

5,411
vm-standaloneot-container-kit0.0.41 of 6See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

3,378
pax-prometheuspaxtecnologia0.7.01 of 8See more

pax-prometheus paxtecnologia 0.7.0

1 of the 8 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

1,826
archive-analysispcp-helm-chartsVerified publisher1.0.11 of 1See more

archive-analysis pcp-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
ghcr.io/performancecopilot/archive-analysis:latest8de11e2363fc
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.10.3

Open the chart page →

1,326
loki-stackpyalive-cdmswebappVerified publisher2.6.51 of 4See more

loki-stack pyalive-cdmswebapp 2.6.5

1 of the 4 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

6,525
grafanaquench-grafanaVerified publisher0.0.121 of 1See more

grafana quench-grafana 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

119
harbor-observabilityquench-harbor-observabilityVerified publisher0.0.101 of 2See more

harbor-observability quench-harbor-observability 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

182
lgtm-stackquench-lgtm-stackVerified publisher0.0.192 of 9See more

lgtm-stack quench-lgtm-stack 0.0.19

2 of the 9 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3
ghcr.io/quenchworks/images/tempodigest-pinned9e889ec33f96
github.com/grafana/tempo@v3.0.3
no fix listed

Open the chart page →

376
logging-stackquench-logging-stackVerified publisher0.0.121 of 3See more

logging-stack quench-logging-stack 0.0.12

1 of the 3 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

190
observability-stackquench-observability-stackVerified publisher0.0.141 of 5See more

observability-stack quench-observability-stack 0.0.14

1 of the 5 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

267
tempoquench-tempoVerified publisher0.0.151 of 1See more

tempo quench-tempo 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/tempodigest-pinned9e889ec33f96
github.com/grafana/tempo@v3.0.3
no fix listed

Open the chart page →

83
tracing-stackquench-tracing-stackVerified publisher0.0.92 of 3See more

tracing-stack quench-tracing-stack 0.0.9

2 of the 3 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3
ghcr.io/quenchworks/images/tempodigest-pinned9e889ec33f96
github.com/grafana/tempo@v3.0.3
no fix listed

Open the chart page →

283
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.4.0d8ea37798ccc
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.10.3

Open the chart page →

9,355
radar-grafanaradar-baseVerified publisher0.1.41 of 2See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.6.062d2b9d20a19
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.10.3

Open the chart page →

1,667
speedtestsantisbon0.1.01 of 3See more

speedtest santisbon 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

12,668
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

1,795
temposb-helm-charts0.4.01 of 1See more

tempo sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/tempo:2.9.065a578975943
github.com/grafana/tempo@v0.0.0-20251008140505-607c7fb69662
2.10.3

Open the chart page →

923
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

7,708
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.10.3

Open the chart page →

7,901
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

4,974
stunner-prometheusstunner0.2.11 of 4See more

stunner-prometheus stunner 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

3,025
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

6,973
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

4,526
victoria-metrics-k8s-stackwenerme0.92.11 of 7See more

victoria-metrics-k8s-stack wenerme 0.92.1

1 of the 7 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.10.3

Open the chart page →

1,889
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.10.3

Open the chart page →

9,381
prometheus-monitoring-stackyotron-helm-charts1.2.01 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-28377.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.10.3

Open the chart page →

878

Container images carrying it

51 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/opstree/tempo:2.10.4-debian13cb734024b3fd
github.com/grafana/tempo@v0.0.0-20260413105002-54b109f75993
2.10.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.