6.5Mittel
CVE-2026-62147Tempo-operator: tempo operator: query rbac bypass
Beschreibung
The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.
Schwachstellentyp (CWE):
CWE-863
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| openshift distributed tracing | 3.10 | — | |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | all versions |
Referenzen und Patches
- RHSA-2026:33612 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-62147 vdb-entry
- RHBZ#2499635 issue-tracking