What is the CVSS score of EUVD-2026-43489?

EUVD-2026-43489 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Tempo Operator EUVD-2026-43489

| CVE-2026-62147 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-13 redhat

Authentication Bypass Red Hat Red Hat Openshift Distributed Tracing 3 Red Hat

6.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible gateway API, low complexity, authenticated low-privilege user sufficient; pure confidentiality impact with no integrity or availability effect and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 12:30 vuln.today

DescriptionCVE.org

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.

AnalysisAI

Tenant data leakage in the Tempo Operator gateway component (Red Hat OpenShift Distributed Tracing 3) allows an authenticated low-privileged user to read span attributes from namespaces belonging to other tenants. The flaw exists because namespace-scoped redaction is inconsistently applied across certain query API response paths when query RBAC is enabled, meaning the authorization control exists but is not uniformly enforced. No public exploit code has been identified and this CVE is not listed in CISA KEV, but the high confidentiality impact and low attack complexity make it a meaningful risk in shared multi-tenant tracing deployments.

Technical ContextAI

Grafana Tempo is a distributed tracing backend; the Tempo Operator is its Kubernetes operator, deployed in Red Hat OpenShift Distributed Tracing 3 (CPE: cpe:2.3:a:red_hat:red_hat_openshift_distributed_tracing_3). The gateway component in this operator proxies query API requests and enforces namespace-scoped RBAC to isolate tenant trace data. CWE-863 (Incorrect Authorization) describes the root cause: the authorization logic exists but is not consistently invoked across all query API response paths, creating blind spots where redaction is silently skipped. This class of flaw typically arises when authorization is applied at the request-routing layer but not enforced again at the response-serialization or sub-path layer, leaving certain endpoint branches unguarded.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-62147 and the linked Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2499635 for the official patched version; no specific fix version was confirmed in the data available for this analysis. Until a patch is applied, the most direct compensating control is to disable query RBAC on the Tempo Operator gateway if the feature can be foregone, though this may reduce isolation between tenants and could itself be an unacceptable trade-off depending on cluster policy. Alternatively, restrict Tempo gateway query API access to a single trusted tenant or operator-only service account at the network policy level, preventing cross-tenant authenticated access entirely - this limits tracing query functionality but eliminates the exposure surface. In environments where strict tenant isolation is critical and a patch is not yet available, consider temporarily disabling the Tempo gateway's external query endpoint and routing trace queries through a controlled internal path with manual redaction auditing.