CVE-2026-62147

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:33612
https://access.redhat.com/security/cve/CVE-2026-62147
https://bugzilla.redhat.com/show_bug.cgi?id=2499635

Configurations

No configuration.

History

31 Oct 2026, 04:18

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2026:33612 -

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El componente de puerta de enlace del Operador de Tempo falló al aplicar consistentemente la redacción con ámbito de espacio de nombres en algunas rutas de respuesta de la API de consulta cuando RBAC de consulta estaba habilitado, permitiendo a un usuario autenticado leer atributos de span pertenecientes a los espacios de nombres de otros inquilinos.

Information

Published : 2026-07-13 12:16

Updated : 2026-10-31 04:18

NVD link : CVE-2026-62147

Mitre link : CVE-2026-62147

CVE.ORG link : CVE-2026-62147

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-62147", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62147", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T13:43:40.942746Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.10.1", "versions": [{"status": "unaffected", "version": "1782510941", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/tempo-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.10.1", "versions": [{"status": "unaffected", "version": "1782501195", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/tempo-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-07-13T12:16:34.927", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:33612", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-62147", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499635", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces."}, {"lang": "es", "value": "El componente de puerta de enlace del Operador de Tempo fall\u00f3 al aplicar consistentemente la redacci\u00f3n con \u00e1mbito de espacio de nombres en algunas rutas de respuesta de la API de consulta cuando RBAC de consulta estaba habilitado, permitiendo a un usuario autenticado leer atributos de span pertenecientes a los espacios de nombres de otros inquilinos."}], "lastModified": "2026-10-31T04:18:20.217", "sourceIdentifier": "secalert@redhat.com"}