RHSA-2026:33612 - Security Advisory

Topic

Red Hat OpenShift distributed tracing platform (Tempo) 3.10.1 has been released

Description

This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements and bug fixes.

Breaking changes:

• None

Deprecations:

• None

Technology Preview features:

• None

Enhancements:

• None

Bug fixes:

• Gateway query RBAC no longer fails to decode zstd-encoded responses: Before this update, the gateway query RBAC feature could not decode zstd-encoded responses from the Tempo API. As a consequence, the Tracing UI in the OpenShift Container Platform console failed with an "Error 502 Bad Gateway" message. With this update, the gateway query RBAC feature correctly decodes zstd-encoded responses. As a result, the Tracing UI works correctly. For more information, see https://redhat.atlassian.net/browse/TRACING-6419.
• Gateway query RBAC no longer exposes data from unauthorized namespaces: Before this update, the gateway failed to correctly redact some Tempo API responses when Query RBAC was enabled. As a consequence, users could see sensitive data from namespaces they were not authorized to access. With this update, the gateway correctly redacts all Tempo API responses. As a result, users only see data from namespaces to which they have access. For more information, see https://redhat.atlassian.net/browse/TRACING-6438.
• sort no longer fails or leaks data when using the traditional key format: Before this update, the sort utility in GNU Coreutils had a heap buffer under-read vulnerability in the begfield() function. When a user ran a sort command using the traditional key format, the program could access memory outside the allocated buffer. As a consequence, a crafted input could cause a crash or leak sensitive data. With this update, the buffer boundaries are properly validated. As a result, the sort utility no longer accesses memory outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2025-5278.
• Error messages in the net/textproto package no longer include unsanitized input: Before this update, functions in the Go net/textproto package included their input as part of error messages without sanitization. As a consequence, an attacker could inject misleading content into these error messages. When printed or logged, the manipulated messages could cause confusion or misinterpretation of critical system information. With this update, the error messages no longer include unsanitized input. As a result, injected content can no longer appear in error output from the net/textproto package. For more information, see https://access.redhat.com/security/cve/cve-2026-42507.

Known issues:

• None

Solution

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators

Affected Products

• Red Hat OpenShift distributed tracing

Fixes

• TRACING-6419 - [regression] Query RBAC does not work with zstd encoding
• TRACING-6438 - Query RBAC does not redact responses from some Tempo API endpoints

CVEs

• CVE-2025-5278
• CVE-2026-42507

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo