cve.bz

CVE-2025-2842

4.3 mediumEPSS 0.4%

Medium (4.3). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/grafana/tempo-operator 0.16.0.

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE
CWE-200
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-5xf3-gmx4-529vGogithub.com/grafana/tempo-operator<0.16.00.16.0
GO-2026-5161Gogithub.com/grafana/tempo-operator<0.16.00.16.0

References

Check your stackJSON