4.3
Medium
CVE-2025-2842 A flaw was found in the Tempo Operator
Description
A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift distributed tracing 3.5.2 | Versions not published | |
| Red Hat OpenShift distributed tracing 3 | Versions not published | |
| Red Hat OpenShift distributed tracing 3.5.1 | Versions not published | |
| Red Hat OpenShift distributed tracing 3.5 | Versions not published | |
| Red Hat OpenShift distributed tracing 3.5.3 | Versions not published |
References
- RHSA-2025:3607 access.redhat.com
- RHSA-2025:3740 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2355219 bugzilla.redhat.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift distributed tracing 3.5.2
The 4 CVEs of Red Hat OpenShift distributed tracing 3.5.2 →
CVE-2025-7425
Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr
7.8
High
CVE-2025-5914
Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
7.8
High
CVE-2025-2786
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user…
4.3
Medium