CVE-2026-62147

Tempo-operator: tempo operator: query rbac bypass

View on CVE.org
Published Jul 13, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.

Analysis

AI-generated

Technical impact

The Tempo Operator’s gateway component fails to apply namespace‑scoped redaction to certain query API responses when query RBAC is enabled, allowing an authenticated user to read span attributes that belong to other tenants. This authorization bypass (CWE‑863) exposes telemetry data to users who should not have access, thereby compromising tenant isolation and potentially revealing sensitive operational metrics.

Affected Systems

Red Hat OpenShift distributed tracing 3 is affected. All released versions prior to tempo‑operator v0.21.0‑2 are vulnerable; the issue is patched in that release and later versions.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score of less than 1% signals a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user with RBAC permissions to issue query‑API requests; by sending specially crafted queries an attacker can retrieve span attributes from namespaces they are not authorized to view.

Remediation

Vendor Workaround

There is no mitigation or workaround other than upgrading to tempo-operator.v0.21.0-2 (or later); until upgraded, administrators requiring strict namespace isolation of trace data should not rely on query RBAC alone and should consider restricting access to the Tempo query API at the network/route level as a temporary compensating control.

OpenCVE Recommended Actions

  • Apply the latest tempo‑operator update (v0.21.0‑2 or later) to resolve the authorization bypass (CWE‑863).
  • If an upgrade cannot be performed immediately, restrict network or route access to the Tempo query API so that only namespaces with proper RBAC permissions can query the endpoint, mitigating the cross‑namespace read.
  • As a temporary control, disable query RBAC or enforce tighter network isolation until the patch is deployed, while monitoring for other authorization issues.

Generated by OpenCVE AI on July 31, 2026 at 11:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_distributed_tracing:3 cpe:/a:redhat:openshift_distributed_tracing:3.10::el9
References
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.
Title Tempo-operator: tempo operator: query rbac bypass
First Time appeared Redhat
Redhat openshift Distributed Tracing
Weaknesses CWE-863
CPEs cpe:/a:redhat:openshift_distributed_tracing:3
Vendors & Products Redhat
Redhat openshift Distributed Tracing
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Oct 31, 2026, 3:58 AM
Reserved
Jul 13, 2026, 11:29 AM

View source JSON

Updated
Jul 13, 2026, 1:43 PM

JSON

Status
Awaiting Analysis
Published
Jul 13, 2026, 12:16 PM
Modified
Oct 31, 2026, 4:18 AM

View source JSON

Severity
Moderate
Public date
Jul 13, 2026, 10:00 AM

View source Bugzilla JSON

Updated
Jul 31, 2026, 11:45 AM

JSON