Threat intelligence dashboard
CVE-2026-62147medium

Tempo-operator: tempo operator: query rbac bypass

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.

Risk score

6.5

CVSS 3.1

Vendor
Red Hat
Product
Red Hat OpenShift distributed tracing 3.10.1
CWE
CWE-863
Published
Jul 13, 2026
Updated
Oct 31, 2026
CISA KEV
Not flagged

Affected products and versions

Red Hat OpenShift distributed tracing 3.10.1

Red Hat

Version / rangeStatusType
1782510941 to before *unaffectedrpm

Red Hat OpenShift distributed tracing 3.10.1

Red Hat

Version / rangeStatusType
1782501195 to before *unaffectedrpm

Technical metrics

6.5

CVSS 3.1

Severity
medium
Source
redhat
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N