PT-2026-57809 · Red Hat · Red Hat Openshift Distributed Tracing 3

Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-62147

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-62147

Affected Products

Red Hat Openshift Distributed Tracing 3

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-62147 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2499635 · Note
• https://access.redhat.com/security/cve/CVE-2026-62147 · Note