GHSA-5xf3-gmx4-529v
Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/grafana/tempo-operator | < 0.16.0 | 0.16.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole.
This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-2842
- https://github.com/grafana/tempo-operator/pull/1144
- https://github.com/grafana/tempo-operator/commit/60b538c45f76755262e211d8df0e601a716308c7
- https://access.redhat.com/errata/RHSA-2025:3607
- https://access.redhat.com/errata/RHSA-2025:3740
- https://access.redhat.com/security/cve/CVE-2025-2842
- https://bugzilla.redhat.com/show_bug.cgi?id=2355219
- https://github.com/grafana/tempo-operator
- https://github.com/grafana/tempo-operator/blob/8d1c7f13cb0f8db490144b04665b1fd6a2d56307/CHANGELOG.md?plain=1#L342