CVE-2025-2842
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A flaw in Tempo Operator where enabling Jaeger UI Monitor Tab creates a ClusterRoleBinding for the Tempo service account, granting cluster-monitoring-view role. A user with permissions to create TempoStack and read secrets in a namespace can read the service account token and access all cluster metrics.
Risk Assessment
The risk is unauthorized access to all cluster metrics, potentially leaking sensitive infrastructure information and facilitating further attacks.
Recommendation
Immediately disable the Jaeger UI Monitor Tab if not needed, restrict permissions for creating TempoStack and reading secrets, and consider updating Tempo Operator to a patched version.
Other vulnerabilities in Tempo Operator
See all- CVE-2026-62147Medium
A vulnerability in the Tempo Operator's gateway component causes inconsistent namespace-scoped redaction in query API responses when RBAC is enabled. This allows an authenticated user to read span attributes belonging to other tenants' namespaces.
- CVE-2025-2786Medium
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions.
Original NVD description (English source)
A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS