Is github.com/grafana/tempo safe to use?

Vulert records 6 vulnerabilities for github.com/grafana/tempo in Go: 0 critical, 2 high, 1 medium and 0 low, plus 3 not yet rated. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/grafana/tempo's Vulert package health score?

Vulert scores github.com/grafana/tempo 76/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Which version of github.com/grafana/tempo should I use?

v1.5.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/grafana/tempo have?

6 vulnerabilities are recorded for github.com/grafana/tempo in the Go ecosystem: 0 critical, 2 high, 1 medium and 0 low, plus 3 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/grafana/tempo vulnerabilities disclosed?

6 vulnerabilities were recorded for github.com/grafana/tempo in the last 12 months, and the oldest entry in this database dates to 27 Mar 2026. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/grafana/tempo are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/grafana/tempo for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at https://vulert.com/scanner and Vulert keeps checking the github.com/grafana/tempo version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.

Vulnerability Database · Go · Package report

github.com/grafana/tempo: vulnerability history, versions and safety

github.com/grafana/tempo is a package in the Go ecosystem. Vulert records 6 vulnerabilities for it across 120 releases, from Mar 2026 to Sep 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

6 vulnerabilities recorded H2 M1 U3

2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →

6 in the last 12 months

Most recent disclosure 02 Sep 2026.

See the disclosure history →

0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/grafana/tempo vulnerabilities

Vulert verdict on github.com/grafana/tempo v1.5.0 i

Updated on 23 Oct 2026

Careful: 2 of the 6 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 76/100

Security Some issues to review
Maintenance Sustainable
Popularity Key ecosystem project
Community Active

What to do: Plan around the 2 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

Current release v1.5.0 — unaffected i
Vulnerabilities on record 6 over 1 year · 6 in the last year i
Latest disclosure 02 Sep 2026 i
Highest CVSS 7.5 i
With no published fix 2 i
Stars 5,542 i
OpenSSF scorecard 7/10 i
Last release this month i
Licence AGPL-3.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

Scan your app free →

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/grafana/tempo, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

Version	Released	Vulert vulnerabilities	Licence	Fix published	Details
v0.0.0-20261021152436-9db7df79d2af	21 Oct 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20261021152436-9db7df79d2af	21 Oct 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20261021141112-9e06ff121130	21 Oct 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20261021135948-f317720e7e51	21 Oct 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20261020161819-b2c8f737b763	20 Oct 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20261016195120-8a90dd3793b8	16 Oct 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20261016195120-8a90dd3793b8	16 Oct 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260929163304-77fc4563d113	29 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260929163304-77fc4563d113	29 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260924180803-6c332d00133e	24 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260922181537-87ed52766f53	22 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260922072413-aed05911d519	22 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260921215021-4c51ad3d5faa	21 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260921215021-4c51ad3d5faa	21 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260921202146-b6cb7d85b1db	21 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260921202146-b6cb7d85b1db	21 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260921193608-862b333ad5c2	21 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260921182929-34eecd7940f3	21 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260921182929-34eecd7940f3	21 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260918211620-6822b8f094ae	18 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260918211620-6822b8f094ae	18 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260918191209-cd0967cb21b2	18 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260918191209-cd0967cb21b2	18 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260918133116-7a28509b3249	18 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260918133116-7a28509b3249	18 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260918095031-bbe55cacfaea	18 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260917200640-bd0e8494b737	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260917200640-bd0e8494b737	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260917172706-9295aaaf6b3f	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260917172706-9295aaaf6b3f	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260917164741-75a70443e7c5	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260917164741-75a70443e7c5	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260917152703-bfeb1a8efa01	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260917141723-97bc902ebb1b	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260917135739-98e29ca8b01f	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260917133153-50850b7acf72	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260917083724-2ccb56786133	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260917083724-2ccb56786133	17 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916202308-11d130b67430	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260916202308-11d130b67430	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916191430-a3c7d6c65ed6	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260916191430-a3c7d6c65ed6	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916182106-6de38f500974	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916174417-7e3ad964f8ab	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916174346-55cdc526f0d1	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260916170942-05396cf23e29	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916162324-39bd42c83de6	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260916162324-39bd42c83de6	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916155554-40c938b447de	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260916155554-40c938b447de	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916124103-8d6dce195ce1	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260916124103-8d6dce195ce1	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916093144-685ce2b9ee8f	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260916093144-685ce2b9ee8f	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260916075417-7051a4a49648	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260916075417-7051a4a49648	16 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260915211017-52c7ee37becf	15 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260915211017-52c7ee37becf	15 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260915140951-3cf7cebf77e3	15 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260915140951-3cf7cebf77e3	15 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260915102444-2c6dcdd06534	15 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260915102444-2c6dcdd06534	15 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260914143826-f227ccdf89c1	14 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260914143826-f227ccdf89c1	14 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260910145902-6ddb03696108	10 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260910145902-6ddb03696108	10 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260910135652-3ea9c75dbba5	10 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260910135652-3ea9c75dbba5	10 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260910130453-bcfe9f230c1d	10 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260910130453-bcfe9f230c1d	10 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260910123737-52f04c65a704	10 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260910090920-863108a559ab	10 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260910090920-863108a559ab	10 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260909121539-a3184c59a671	09 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260909121539-a3184c59a671	09 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260908174947-6106d61676a1	08 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260908174947-6106d61676a1	08 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260908173625-ec5445a2e368	08 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260908173625-ec5445a2e368	08 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260901154419-a991753653a1	01 Sep 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260831115516-bf9dbd054c59	31 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260831115516-bf9dbd054c59	31 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260828190359-049347c45538	28 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260828190359-049347c45538	28 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260828165602-c64f0ee52cd9	28 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260828084430-15a5302e88a7	28 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260828084430-15a5302e88a7	28 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260827161608-871b4a635b58	27 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260827161608-871b4a635b58	27 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260826221449-fb8df98f5db0	26 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260826221449-fb8df98f5db0	26 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260826135550-b03ea7776841	26 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260826135550-b03ea7776841	26 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260826114403-5199b0ff41da	26 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260825212916-f049c8c6d435	25 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260825212916-f049c8c6d435	25 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260825141650-9c4a5fb95443	25 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260825141650-9c4a5fb95443	25 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260825102246-11060b912ee5	25 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v1.5.1-0.20260825102246-11060b912ee5	25 Aug 2026	H1 M1 U2	AGPL-3.0	No	Details →
v0.0.0-20260825072320-618af3e6b7d0	25 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260825072320-618af3e6b7d0	25 Aug 2026	H1 M1 U2	—	No	Details →
v0.0.0-20260824140139-f79559aa97db	24 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260824140139-f79559aa97db	24 Aug 2026	H1 M1 U2	—	No	Details →
v0.0.0-20260821172745-ad33aa8fafc4	21 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260821172745-ad33aa8fafc4	21 Aug 2026	H1 M1 U2	—	No	Details →
v0.0.0-20260821150230-31ee026d2c7d	21 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260821150230-31ee026d2c7d	21 Aug 2026	H1 M1 U2	—	No	Details →
v0.0.0-20260820213353-df84e7ff218a	20 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260820213353-df84e7ff218a	20 Aug 2026	H1 M1 U2	—	No	Details →
v0.0.0-20260819191839-494bf227fbcc	19 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260819191839-494bf227fbcc	19 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260819191557-dd7c59030509	19 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260819191551-9a361c267898	19 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260819164524-1ba331206568	19 Aug 2026	H1 M1 U2	—	No	Details →
v0.0.0-20260818213157-fdbc4e9849d3	18 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260818213157-fdbc4e9849d3	18 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260818144815-1040d0f4db9b	18 Aug 2026	H1 M1 U2	—	No	Details →
v0.0.0-20260814141003-4d876b4d6ded	14 Aug 2026	H1 M1 U2	—	No	Details →
v1.5.1-0.20260814141003-4d876b4d6ded	14 Aug 2026	H1 M1 U2	—	No	Details →

The newest 120 of 3,152 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

2026 6

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 6 of the 6 were recorded in the last 12 months.

Other ways into the data

03 Vulnerabilities

Recorded vulnerabilities for github.com/grafana/tempo

Vulnerability	Severity	Fixed version ↓	Disclosed ↓
CVE-2026-21728: Grafana Tempo Uncontrolled Resource Consumption Vulnerability	7.5 high	2.8.4	24 Apr 2026
CVE-2026-28377: Grafana Tempo Exposes S3 SSE-C Encryption Key in Plaintext	7.5 high	2.10.3	27 Mar 2026
CVE-2026-27878: Grafana Tempo Out-of-Memory Crash Vulnerability	6.5 medium	1.5.1-0.20260303204923-b13f74291d48	19 Jun 2026
CVE-2026-28377: Inadequate Encryption Strength in Grafana Tempo	N/A unrated	No fix published	25 Jun 2026
CVE-2026-21728: Grafana Tempo Uncontrolled Resource Consumption Vulnerability	N/A unrated	No fix published	25 Jun 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315