CVE-2025-2786
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions.
Risk Assessment
The risk involves information disclosure about other users' permissions, which could aid in gathering information for further attacks, although it does not allow privilege escalation or impersonation.
Recommendation
It is recommended to restrict access to namespaces where TempoStack or TempoMonolithic instances are deployed and monitor TokenReview and SubjectAccessReview requests for unusual activity.
Other vulnerabilities in Tempo Operator
See all- CVE-2026-62147Medium
A vulnerability in the Tempo Operator's gateway component causes inconsistent namespace-scoped redaction in query API responses when RBAC is enabled. This allows an authenticated user to read span attributes belonging to other tenants' namespaces.
- CVE-2025-2842Medium
A flaw in Tempo Operator where enabling Jaeger UI Monitor Tab creates a ClusterRoleBinding for the Tempo service account, granting cluster-monitoring-view role. A user with permissions to create TempoStack and read secrets in a namespace can read the service account token and access all cluster metrics.
Original NVD description (English source)
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS