CVE-2025-2842 | BDVDB-2026-273142 Detail

Description#

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-04-02Record published in the CVE List.
2. Version 22026-09-08Most recent update recorded in the CVE List.