CVE-2026-62147
MediumCVSS 6.5Summary
A vulnerability in the Tempo Operator's gateway component causes inconsistent namespace-scoped redaction in query API responses when RBAC is enabled. This allows an authenticated user to read span attributes belonging to other tenants' namespaces.
Risk Assessment
The organization is at risk of telemetry data leakage between tenants, potentially compromising confidentiality and data isolation in a multi-tenant environment.
Recommendation
Immediately update Tempo Operator to a version that fixes the API response redaction. Until then, restrict query API access to trusted users only.
Other vulnerabilities in Tempo Operator
See all- CVE-2025-2842Medium
A flaw in Tempo Operator where enabling Jaeger UI Monitor Tab creates a ClusterRoleBinding for the Tempo service account, granting cluster-monitoring-view role. A user with permissions to create TempoStack and read secrets in a namespace can read the service account token and access all cluster metrics.
- CVE-2025-2786Medium
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions.
Original NVD description (English source)
The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.