Tempo Operator CVE-2026-62147

Exploitation requires three concrete conditions to be true simultaneously: (1) the Tempo Operator gateway must be deployed with query RBAC explicitly enabled - this is a non-default or operator-configured state; (2) the attacker must hold a valid authenticated session with at least low-privilege access to the OpenShift cluster or Tempo gateway API (PR:L per CVSS vector); and (3) the target environment must be multi-tenant, meaning other namespaces with span data must exist. What limits exploitation is the authentication requirement - unauthenticated external attackers cannot exploit this - and the dependency on query RBAC being active; single-tenant deployments or deployments with RBAC disabled on the gateway are not affected by this specific flaw. The non-default RBAC configuration requirement meaningfully narrows the exposed population.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 and accurately reflects the threat model: network-reachable, low complexity, requires only a valid authenticated session, and yields high confidentiality impact limited to the vulnerable system with no integrity or availability consequence. There is no KEV listing and no public exploit code has been identified at time of analysis, which tempers immediate urgency. However, the low attack complexity combined with no user interaction means that any authenticated tenant user - potentially a low-trust internal or external party - can reliably exploit this without requiring special tooling. The real-world risk is highest in shared multi-tenant OpenShift clusters where tracing data may contain sensitive application telemetry, service topology, or business-logic parameters embedded in span attributes. EPSS data was not provided in the input; severity should be contextualized by whether the cluster hosts untrusted or externally-facing tenants.

An authenticated user with a valid low-privileged account in a multi-tenant OpenShift cluster submits a query to the Tempo Operator gateway's query API targeting a response path where namespace-scoped redaction is not enforced. The response returns span attributes - potentially containing service names, operation parameters, or application-layer metadata - belonging to a different tenant's namespace, which the user is not authorized to see. No public exploit code has been identified, but the attack requires only standard HTTP query tooling and knowledge of the unguarded API path.