Grafana Tempo 3.1.0-rc.1 security fixes

{
  "id": "e57769e5f46f940b02e8d70e84623cab7585fd8ee9f333f7b59f662273a25d76",
  "url": "https://github.com/grafana/tempo/releases/tag/v3.1.0-rc.1",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Grafana Tempo 3.1.0-rc.1 security fixes",
    "summary": "Grafana Tempo 3.1.0-rc.1 prevents cross-tenant redaction and updates memcached components to address known vulnerabilities. It also signs published container images and attaches build provenance.",
    "evidence": "Security fixes backend-scheduler: Prevent cross-tenant redaction by taking the target tenant exclusively from the request context (X-Scope-OrgID), ignoring the request body's tenant_id field. (#7153) (@zalegrala) operations: Sign all published container images (tempo, tempo-vulture, tempo-query, and tempo-cli) with keyless cosign signatures and attach SLSA build provenance. (#7493, #7534, #7543, #7565, #7601) (@mattdurham) operations: Update memcached to 1.6.42-alpine and prom/memcached-exporter to v0.16.0 to address known vulnerabilities. (#7244) (@zhxiaogg)",
    "products": [
      {
        "name": {
          "value": "Grafana Tempo",
          "evidence": "Grafana Tempo 3.1 adds query-based trace redaction"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v3.1.0-rc.1",
            "evidence": "v3.1.0-rc.1"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "memcached",
          "evidence": "Update memcached to 1.6.42-alpine"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.6.42-alpine",
            "evidence": "Update memcached to 1.6.42-alpine"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "prom/memcached-exporter",
          "evidence": "prom/memcached-exporter to v0.16.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v0.16.0",
            "evidence": "prom/memcached-exporter to v0.16.0"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-grafana-tempo",
  "document_id": 21325,
  "published_at": "2026-09-17T17:37:20+00:00"
}