Bug 2499635 (CVE-2026-62147)

Summary:	CVE-2026-62147 tempo-operator: Tempo Operator: Query RBAC bypass
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mwringe
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-13 10:03:40 UTC

A flaw was found in the Tempo Operator's gateway component used by Red Hat OpenShift distributed tracing platform to enforce per-namespace access control on trace queries; when query RBAC is enabled, an authorization logic error caused some query API code paths to skip the expected redaction, allowing a user authorized for at least one namespace's traces to retrieve span attributes from namespaces they are not authorized to access. The highest threat is to confidentiality of tracing data; there is no impact to integrity, availability, or broader cluster privileges, and deployments that do not enable query RBAC are not affected by this specific bypass.

Comment 1 Yadnyawalk Tale 2026-07-13 10:09:20 UTC

CVSS Justification:
AV:N (Network) — The Tempo query API/gateway is reachable over the network (e.g., via a route/service), so no local access to a node or pod is needed.
AC:L (Low) — Exploitation just requires sending a normal query request to the affected endpoints; no special conditions or timing are involved.
PR:L (Low) — Attacker needs to be an authenticated user with access to at least one namespace's traces, not elevated/admin privileges.
UI:N (None) — No action from another user or admin is required to trigger the unredacted response.
S:U (Unchanged) — The bypass stays within the same security authority (the tracing platform's own authorization layer); it doesn't escalate into a different component or host boundary.
C:H (High) — An attacker can read span attributes from namespaces they aren't authorized for, with no restriction on which namespaces' data is exposed.
I:N (None) — The flaw only discloses data; it doesn't allow modifying trace data, configuration, or anything else.
A:N (None) — There's no impact on availability of the tracing service or any other component.