CVE-2026-62147

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62147", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-07-13T11:29:50.979Z", "datePublished": "2026-07-13T11:43:59.024Z", "dateUpdated": "2026-10-31T03:58:23.942Z"}, "containers": {"cna": {"title": "Tempo-operator: tempo operator: query rbac bypass", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.10.1", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/tempo-operator-bundle", "defaultStatus": "affected", "versions": [{"version": "1782510941", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.10.1", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/tempo-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1782501195", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:33612", "name": "RHSA-2026:33612", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-62147", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499635", "name": "RHBZ#2499635", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-07-13T10:00:13.312Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-863: Incorrect Authorization", "workarounds": [{"lang": "en", "value": "There is no mitigation or workaround other than upgrading to tempo-operator.v0.21.0-2 (or later); until upgraded, administrators requiring strict namespace isolation of trace data should not rely on query RBAC alone and should consider restricting access to the Tempo query API at the network/route level as a temporary compensating control."}], "timeline": [{"lang": "en", "time": "2026-07-13T09:58:14.425Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-13T10:00:13.312Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-31T03:58:23.942Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T13:43:40.942746Z", "id": "CVE-2026-62147", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T13:43:50.023Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62147", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T13:43:40.942746Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T13:43:46.378Z"}}], "cna": {"title": "Tempo-operator: tempo operator: query rbac bypass", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.10.1", "versions": [{"status": "unaffected", "version": "1782510941", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/tempo-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.10.1", "versions": [{"status": "unaffected", "version": "1782501195", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/tempo-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-07-13T09:58:14.425Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-13T10:00:13.312Z", "value": "Made public."}], "datePublic": "2026-07-13T10:00:13.312Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:33612", "name": "RHSA-2026:33612", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-62147", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499635", "name": "RHBZ#2499635", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "There is no mitigation or workaround other than upgrading to tempo-operator.v0.21.0-2 (or later); until upgraded, administrators requiring strict namespace isolation of trace data should not rely on query RBAC alone and should consider restricting access to the Tempo query API at the network/route level as a temporary compensating control."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-31T03:58:23.942Z"}, "x_redhatCweChain": "CWE-863: Incorrect Authorization"}}, "cveMetadata": {"cveId": "CVE-2026-62147", "state": "PUBLISHED", "dateUpdated": "2026-10-31T03:58:23.942Z", "dateReserved": "2026-07-13T11:29:50.979Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-07-13T11:43:59.024Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"], "defaultStatus": "affected", "packageName": "rhosdt/tempo-operator-bundle", "product": "Red Hat OpenShift distributed tracing 3.10.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782510941", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"], "defaultStatus": "affected", "packageName": "rhosdt/tempo-rhel9-operator", "product": "Red Hat OpenShift distributed tracing 3.10.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782501195", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces."}, {"lang": "es", "value": "El componente de puerta de enlace del Operador de Tempo fall\u00f3 al aplicar consistentemente la redacci\u00f3n con \u00e1mbito de espacio de nombres en algunas rutas de respuesta de la API de consulta cuando RBAC de consulta estaba habilitado, permitiendo a un usuario autenticado leer atributos de span pertenecientes a los espacios de nombres de otros inquilinos."}], "id": "CVE-2026-62147", "lastModified": "2026-10-31T04:18:20.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62147", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-13T13:43:40.942746Z", "version": "2.0.3"}}]}, "published": "2026-07-13T12:16:34.927", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:33612"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-62147"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499635"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "tempo-operator: Tempo Operator: Query RBAC bypass", "id": "2499635", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499635"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces."], "mitigation": {"lang": "en:us", "value": "There is no mitigation or workaround other than upgrading to tempo-operator.v0.21.0-2 (or later); until upgraded, administrators requiring strict namespace isolation of trace data should not rely on query RBAC alone and should consider restricting access to the Tempo query API at the network/route level as a temporary compensating control."}, "name": "CVE-2026-62147", "package_state": [{"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3", "fix_state": "Fix deferred", "package_name": "rhosdt/tempo-operator-bundle", "product_name": "Red Hat OpenShift distributed tracing 3"}, {"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3", "fix_state": "Fix deferred", "package_name": "rhosdt/tempo-rhel9-operator", "product_name": "Red Hat OpenShift distributed tracing 3"}], "public_date": "2026-07-13T10:00:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-62147\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62147"], "statement": "This affects Red Hat OpenShift distributed tracing platform deployments with the Tempo Operator's query RBAC feature enabled prior to tempo-operator.v0.21.0-2, which corrects the gateway's authorization handling; the fix has already shipped to customers via RHSA-2026:33612.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 96.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift distributed tracing 3", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_distributed_tracing", "vendor": "redhat"}], "created": "2026-07-13T14:15:15.630998+00:00", "updated": "2026-07-31T11:45:13.192711+00:00", "vendors": ["redhat", "redhat$PRODUCT$openshift_distributed_tracing"]}