Tempo Operator Gateway Namespace Redaction Bypass

Executive Summary

CVE-2026-62147 is a vulnerability in the Tempo Operator's gateway component, which is part of Red Hat OpenShift's distributed tracing platform. The flaw involves an authorization bypass in query RBAC (Role-Based Access Control) when it is enabled.

Specifically, the vulnerability occurs because the gateway component fails to consistently apply namespace-scoped redaction on certain query API response paths. This error in the authorization logic allows authenticated users to read span attributes belonging to other tenants' namespaces, even if they are not permitted to access those namespaces.

• The vulnerability affects deployments where query RBAC is enabled.
• An authenticated user with access to traces in at least one namespace can exploit this flaw to retrieve span attributes from namespaces they should not have access to.
• The primary risk is to the confidentiality of tracing data, as the flaw does not impact data integrity, service availability, or broader cluster privileges.
• Exploitation requires network access to the Tempo query API/gateway, as it is reachable over the network.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if the Tempo Operator's gateway component is running with query RBAC enabled and verifying whether unauthorized span attributes from other namespaces are accessible. Since the flaw involves improper redaction in query API responses, you can test for its presence by attempting to access traces from namespaces where the authenticated user lacks explicit permissions.

• Check if query RBAC is enabled in your Tempo Operator deployment. This can typically be verified by inspecting the Tempo Operator's configuration or custom resource definitions (CRDs) for RBAC settings.
• Use a tool like curl or a web browser to send authenticated requests to the Tempo query API endpoints. For example, you can run a command like: curl -u <username>:<password> https://<tempo-gateway-url>/api/traces/<trace-id> and observe if span attributes from unauthorized namespaces are returned.
• Review logs from the Tempo Operator's gateway component for any anomalies or unexpected access patterns to query API paths. Look for entries indicating unauthorized access attempts or improper redaction failures.
• If you have access to the Tempo Operator's source code or debugging tools, inspect the authorization logic in the gateway component to confirm if namespace-scoped redaction is consistently applied across all query API paths.

Useful 0 Not Useful 0

Impact Analysis

If you are using the Tempo Operator with query RBAC enabled, this vulnerability could impact you in the following ways:

• Unauthorized access to sensitive tracing data: An authenticated user with access to traces in one namespace could potentially access span attributes from other namespaces, leading to a breach of data confidentiality.
• Exposure of tenant-specific information: If your deployment handles multiple tenants or sensitive workloads, this flaw could allow users to view tracing data belonging to other tenants, violating privacy or security policies.
• Compliance risks: Unauthorized access to tracing data may result in non-compliance with internal security policies or external regulations, depending on the nature of the data exposed.

The vulnerability does not grant elevated privileges or allow modifications to data, so the impact is limited to unauthorized data access. Deployments that do not enable query RBAC are unaffected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the exposed tracing data contains personally identifiable information (PII) or other protected data of EU citizens, unauthorized access could violate GDPR's confidentiality and data protection requirements. This may lead to non-compliance and potential fines.
• HIPAA (Health Insurance Portability and Accountability Act): If the tracing data includes protected health information (PHI), unauthorized access could violate HIPAA's Privacy Rule, which mandates strict controls over access to health-related data. This could result in compliance violations and penalties.
• Other industry standards: Depending on the nature of the data exposed, this vulnerability could also impact compliance with standards like PCI DSS (if payment-related data is involved) or SOC 2 (if the organization is required to maintain confidentiality and privacy controls).

The specific impact on compliance depends on the type of data handled by your deployment and the regulations applicable to your organization. If the exposed data includes sensitive or regulated information, this vulnerability could lead to non-compliance and associated risks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps to reduce exposure and prevent unauthorized access to sensitive tracing data.

• Disable query RBAC if it is not strictly required for your deployment. According to the provided context, deployments that do not enable query RBAC are unaffected by this vulnerability.
• Apply the latest patches or updates provided by Red Hat for the Tempo Operator. Monitor the bugzilla report (Resource 1) for fixes or workarounds released by the vendor.
• Restrict network access to the Tempo query API/gateway to trusted users and systems. Use network policies or firewalls to limit exposure to authenticated users with legitimate access needs.
• Review and audit user permissions to ensure that authenticated users only have access to namespaces they are explicitly authorized to view. Remove unnecessary permissions to minimize the risk of unauthorized data access.
• Monitor and log all access to the Tempo query API to detect and respond to any suspicious activity. Implement alerts for unusual access patterns or repeated unauthorized access attempts.

Useful 0 Not Useful 0