Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-13T10:00:13 tempo-operator: Tempo Operator: Query RBAC bypass 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE-863

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.

This affects Red Hat OpenShift distributed tracing platform deployments with the Tempo Operator's query RBAC feature enabled prior to tempo-operator.v0.21.0-2, which corrects the gateway's authorization handling; the fix has already shipped to customers via RHSA-2026:33612. There is no mitigation or workaround other than upgrading to tempo-operator.v0.21.0-2 (or later); until upgraded, administrators requiring strict namespace isolation of trace data should not rely on query RBAC alone and should consider restricting access to the Tempo query API at the network/route level as a temporary compensating control. Red Hat OpenShift distributed tracing 3 Fix deferred rhosdt/tempo-operator-bundle Red Hat OpenShift distributed tracing 3 Fix deferred rhosdt/tempo-rhel9-operator https://www.cve.org/CVERecord?id=CVE-2026-62147 https://nvd.nist.gov/vuln/detail/CVE-2026-62147