PT-2025-14478 · Unknown · Tempo Operator

Published 2025-04-02 · Updated 2026-05-20 · CVE-2025-2786

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tempo Operator (affected versions not specified)

Description A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-2786

GHSA-28GR-56HR-PRP6

GO-2026-4996

Affected Products

Tempo Operator

References · 15

• https://access.redhat.com/errata/RHSA-2025:3740 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:3607 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4996 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-28gr-56hr-prp6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2786 · Security Note
• https://github.com/grafana/tempo-operator/commit/0f3f6ad9dec457d67c3d45ceec90e8dfa017329c · Note
• https://github.com/grafana/tempo-operator/pull/1145 · Note
• https://github.com/grafana/tempo-operator · Note
• https://github.com/advisories/GHSA-28gr-56hr-prp6 · Note
• https://t.me/cvedetector/21854 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2354811 · Note
• https://t.me/cvenotify/117317 · Telegram Post
• https://twitter.com/CVEnew/status/1907551256119488643 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2025-2786 · Note
• https://t.me/cvetracker/20570 · Telegram Post