CVE-2025-2842

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

Scoring

Severity

MEDIUM

CVSS base score

4.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS probability

0.38%

CWE

CWE-200

Published

2025-04-02

Last modified

2026-09-08

Affected products

• Red Hat Red Hat OpenShift distributed tracing 3.5.1
• Red Hat Red Hat OpenShift distributed tracing 3.5.1
• Red Hat Red Hat OpenShift distributed tracing 3.5
• Red Hat Red Hat OpenShift distributed tracing 3.5
• Red Hat Red Hat OpenShift distributed tracing 3.5.3
• Red Hat Red Hat OpenShift distributed tracing 3.5.3
• Red Hat Red Hat OpenShift distributed tracing 3.5.1
• Red Hat Red Hat OpenShift distributed tracing 3.5.1

Weakness type

• CWE-200

Related vulnerabilities

• CVE-2026-92960 — vm2 before 3.11.6 Process-wide State Exposure via os and dns
• CVE-2026-92947 — vm2 before 3.11.7 Memory Disclosure via Buffer Pool
• CVE-2026-87820 — CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
• CVE-2026-86464 — In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity
• CVE-2026-54617 — GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler
• CVE-2026-87541 — Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the
• CVE-2026-78960 — Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engin
• CVE-2026-87593 — Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive inform

Markdown version · Browse all CVEs